Comprehensive Privacy Notice

1. Who is the data controller

The controller of your personal data is TM PROMOTORES EN DEPORTE Y ENTRETENIMIENTO, S.A. DE C.V. (“Klaseo”, “we”), a Mexican company that operates the Klaseo platform, with its address at Altamira 611, Office 23, Zona Centro, ZIP 89000, Tampico, Tamaulipas, Mexico. For any privacy matter, including your ARCO rights, write to us at hello@klaseo.com.

2. Our two roles, explained simply

Klaseo is a tool used by academies, schools, clubs, studios and universities (“the Academy”). Depending on who entered your data, we play one of two roles:

• When your Academy enters your data (for example, enrolls your child or records attendance, evaluations or charges), the Academy is the controller of that data and Klaseo is its processor: we store and process it on the Academy's behalf, only to provide the service and following its instructions. We do not use it for our own purposes, we do not sell it and we do not mix it with other academies' data. The Academy must give you its own privacy notice; to exercise your rights over that data you can contact the Academy or write to us, and we will forward your request.
• When you are a direct Klaseo customer or user (the Academy that subscribes to a plan and its administrators, anyone who opens their own account, anyone who requests a demo or writes to us, and visitors to this site), Klaseo is the controller and this notice applies in full.

In both cases we apply the same security measures, and this notice explains how data is handled within the Platform.

3. Data we collect

We collect the data that you, your Academy or your parent or guardian enter on the Platform, plus some technical data generated when you use it. Depending on your role:

3.1 Students and players

Name, date of birth, profile photo (optional), sport, level or category, groups and schedules, attendance, evaluations and comments from coaches, sports statistics and results, ranking position (if they take part in the community) and, if of legal age, their email and phone number.

3.2 Parents and guardians

Name, relationship to the student, email and phone number; acceptance of the Terms and of this notice; the authorization or refusal for the use of the minor's image, with the date it was given; the student's history of fees, payments and balances and, if the Academy issues invoices, the tax data required (RFC tax ID, name or company name, tax regime and tax address).

3.3 Coaches, staff and administrators

Name, email, phone number, role and permissions within the Academy, the groups and schedules they are in charge of, and a record of what they do on the Platform (attendance taken, evaluations, messages). For the Academy that subscribes, also the organization's contact and billing data.

3.4 Payment data

Card payments (Klaseo plans and, when the Academy enables it, tuition through Klaseo Pay) are processed by our payment provider, which captures and safeguards the card number and its security code. Klaseo does not store your full card number. We only receive limited payment data, such as the amount, date, status, transaction reference and, where applicable, the card brand and last four digits. To pay out to the Academy what it collects, we process its bank account details and the identification data the processor requires to enable the service.

3.5 Site visitors and people who contact us

If you request a demo, fill in a form or write to us by email or WhatsApp: name, academy or organization, position, email, phone number, city or country and the content of your message.

3.6 Technical data

IP address, device and browser type, app version, date and time of access and security logs, so the service works and stays protected. We use the IP address to estimate your approximate country only to show you the right language and currency.

4. Minors' data

Many academy students are minors. Their data is collected only with the consent of their parent or guardian, given at enrollment: the Platform asks for the guardian's details and their acceptance of the Terms and of this notice, and separately records, with the date, whether they authorize the use of the minor's image. In addition:

• The guardian may review, correct or request deletion of the minor's data at any time, and exercise ARCO rights on the minor's behalf.
• If the guardian does not authorize the use of the minor's image, the Academy must not publish photos or videos of the minor outside the Platform.
• Contact from other users to a minor through the community features is routed through their guardian.
• We do not use minors' data for advertising and we do not sell it.
• If we detect a minor's account without the required consent, we suspend it and notify the Academy.

5. Sensitive data

Klaseo does not need sensitive data to work. However, some academies record health or physical-condition information about their athletes (for example, allergies, medical conditions, injuries, blood type, weight or height) to look after them during activities. When the Platform handles such data:

• it is collected only with your express written consent (or the guardian's, for a minor), through a signature or electronic acceptance separate from the general acceptance;
• only the Academy staff who need it, such as the coach in charge, can see it;
• it is used only for the student's safety and sports follow-up, never for commercial purposes;
• you may revoke that consent at any time (see section 10).

We do not ask for data about ethnic origin, religious beliefs, political opinions, union membership or sexual orientation.

6. What we use your data for (necessary purposes)

These purposes are necessary to provide the service:

• creating and managing accounts and verifying the identity of whoever logs in;
• running the Academy on the Platform: enrollments, groups, schedules, attendance, evaluations, training and sports progress;
• generating monthly fees, charges, receipts and account statements; processing card payments, including Klaseo Pay when the Academy uses it, and handling disputes and chargebacks;
• sending service notices: payment reminders, schedule changes, confirmations and messages between the Academy, students and guardians;
• invoicing Klaseo plans and complying with tax and legal obligations;
• providing support, handling demo requests and answering your messages;
• protecting the Platform, preventing fraud and unauthorized access, and making backups;
• improving the product with internal, aggregated usage statistics, which we neither sell nor share.

7. Secondary purposes and how to opt out

We also use your data for these purposes, which are not necessary for the service:

• sending you Klaseo news, promotions and content (marketing communications);
• showing your profile, results and position in Klaseo's community and ranking, visible to other users;
• inviting you to satisfaction surveys and to try new features.

You can opt out now or at any time, and we won't deny you the service because of it:

• write to hello@klaseo.com with the subject “Opt out of secondary purposes” and say which ones you refuse;
• on the site forms, tick the box to not receive news;
• every marketing email includes an unsubscribe option;
• visibility in the community and ranking is set from your account settings; for a minor, the guardian sets it.

8. Who we share your data with

We do not sell or rent personal data. We only share it as follows:

With the Academy

The data you or your guardian enter in an Academy's space is seen and managed by that Academy, because it is its controller. If you open your own account and later join an Academy, it will be able to see the data it needs to teach you (name, contact details, level and attendance). Each Academy only sees its own students: isolation between academies is enforced and audited.

With providers who work for us

These providers process data on our behalf, only to provide their service to us and under confidentiality and security obligations. Mexican law calls this a remission (processing by a processor), and it does not require your consent. Current providers:

• Akamai Cloud / Linode: server and database hosting (United States).
• Google Workspace: email.
• StreamPay: card payment processing. Regarding card data, the processor is also accountable under its own privacy notice and the card networks' rules.
• Google Fonts: site typography; it receives your IP address when the page loads.
• WhatsApp (Meta): only if you choose to write to us that way.

Some providers are outside Mexico, mainly in the United States, so your data is hosted there with protection measures equivalent to those in this notice.

Transfers the law allows without your consent

To authorities that request it in accordance with the law; when necessary to recognize, exercise or defend a right in legal proceedings; and when necessary to perform a contract entered into in your interest, such as paying your tuition to the Academy through the processor. We do not make transfers that require your consent; if one ever becomes necessary, we will ask you first.

9. Your ARCO rights

You have the right to Access your data, Rectify it if it is wrong or incomplete, Cancel it when you believe it is not being used in accordance with the law, and Oppose its use for specific purposes. For a minor, these rights are exercised by the guardian.

How to request it

Write to hello@klaseo.com, preferably from the email registered to your account, with the subject “ARCO rights”, and include:

• your full name and the email or other means for our reply;
• a copy of an official ID; if you act for someone else, such as a minor, also the document proving representation (birth certificate, power of attorney or guardianship ruling);
• which right you want to exercise and over which data, clearly stated;
• any detail that helps us locate the data, such as the Academy or the student's name;
• for a rectification, the correct data and, where applicable, a supporting document.

Deadlines

We reply within a maximum of 20 business days from receiving your complete request and, if it applies, we carry it out within the following 15 business days. These periods can be extended only once, for an equal period, when justified and after notifying you. If information is missing, we will ask for it within 5 business days of your request and you will have 10 business days to send it. The process is free of charge; only shipping or copy costs you request might apply.

If your data was entered by an Academy, we will forward your request to it immediately and help it reply within the same deadlines. If you believe we did not handle your request in accordance with the law, you may go to the personal data protection authority.

10. Revoking your consent

You may revoke the consent you gave us at any time, through the same channel and with the same requirements and deadlines as ARCO rights, using the subject “Consent revocation”. We may not always be able to stop using your data immediately, for example when the law requires us to keep it, and revoking consent for a necessary purpose means we will no longer be able to provide the service.

11. How to limit the use or disclosure of your data

• Adjust your profile visibility and ranking participation from your account.
• Unsubscribe from marketing emails using the link included in each one.
• Ask to be added to our exclusion list by writing to hello@klaseo.com; we do not send advertising to anyone on it.
• You can also sign up for Profeco's Public Registry to Avoid Advertising (REPEP).

12. Account deletion

You can request deletion of your account and its data by writing to hello@klaseo.com with the subject “Delete my account”. If your account belongs to an Academy, we will notify it; only what the law requires to be kept, such as payment receipts, is retained.

13. Security and retention

Data travels encrypted over HTTPS/TLS and is stored on access-controlled servers, with per-academy isolation and regular backups. We keep it while the account is active; when an Academy closes its account, its data is deleted or anonymized within a maximum of 90 days, except records the law requires us to keep. If a security breach significantly affects your rights, we will notify you without delay so you can protect yourself.

14. Cookies and similar technologies

We don't use analytics or advertising cookies, or third-party tracking tools. We only use:

• Platform session cookies, needed for you to log in and keep your account secure;
• your browser's local storage, to remember your language and currency;
• Google Fonts, which receives your IP address when loading the site typography.

You can delete or block cookies and local storage from your browser; if you block session cookies, you won't be able to log in.

15. Changes to this notice

We may update this notice due to changes in the law, the Platform or our providers. The current version will always be posted at klaseo.com/privacy.html with its last-updated date. If the change is significant, for example new purposes or transfers that require your consent, we will also notify you in the app or by email before applying it.

16. Your consent

By enrolling or using the Platform after reading this notice, you consent to the processing of your data for the necessary purposes. For sensitive data and minors' data we request the express consent described in sections 4 and 5. This notice forms part of the Terms and Conditions.