Ubica Casa privacy notice

1. Identity of the controller

Strike Gaming Center, S.A.S. de C.V., operating commercially under the brand Ubica Casa(hereinafter "Ubica Casa", "we" or "the Controller"), domiciled in Monterrey, Nuevo León, Mexico, is responsible for processing the personal data it collects through the use of its website ubica.casa, mobile applications, professional dashboards, contact forms and any other digital channel through which you interact with our services.

We operate 100% digitally, with no offices open to the public and no phone support. For any matter related to the protection of your personal data you may contact the Personal Data Department only at the email [email protected], stating in the subject line the right you wish to exercise.

2. Personal data we collect

Ubica Casa collects personal data directly (when you provide it to us), indirectly (through cookies, device identifiers, browsing logs, IP and network addresses) and through legally authorized third parties (verification providers, partner financial institutions, publicly accessible sources and referrers).

2.1. Identification data

Full name, surnames, date of birth, place of birth, nationality, sex, photograph, official ID (INE, passport, immigration form), CURP, RFC, handwritten or electronic signature.

2.2. Contact data

Email, landline and mobile phone numbers, WhatsApp, home and/or mailing address, declared social media accounts, messaging identifiers.

2.3. Academic and employment data

Profession, occupation, company, position, length of employment, proof of income, tax returns, tax status certificates and proof of employment when linked to searching, renting, buying or professional real estate activity.

2.4. Financial and asset data

Data related to real estate (deeds, parcels, liens, appraisal value), credit products (payment capacity, simulations, declared history), account or payment-method information for premium services, and data for issuing digital tax receipts.

2.5. Browsing and platform-usage data

IP address, device identifiers, browser type, operating system, language, date and time of access, pages visited, searches performed, properties viewed and saved, interactions with listings and professionals, approximate geolocation (when you grant permission) and internal messaging logs.

2.6. Sensitive data

Ubica Casa does not collect sensitive personal data in the ordinary course of business. Should a specific service require data deemed sensitive under the LFPDPPP (for example, biometric data for enhanced verification), you will be presented with an additional simplified privacy notice together with an express, written request for your consent.

3. Purposes of processing

3.1. Primary purposes (necessary)

The personal data we collect will be used for the following purposes that are necessary to provide the service. They do not require express consent beyond the consent implied by your use of the site:

• Create, authenticate, maintain and manage your account on the platform.
• Allow you to search, compare, save and contact published properties.
• Allow owners, agents, agencies and developers to publish real estate inventory.
• Enable communication between users and interested parties through internal messaging and forms.
• Process payments for premium services, professional plans, featured listings and paid modules.
• Issue digital tax receipts (CFDI) when you request invoicing.
• Handle requests, inquiries, claims, reports and ARCO rights.
• Prevent, investigate and report fraud, abuse, identity theft and misuse of the service.
• Comply with legal, regulatory, tax, accounting and judicial obligations.
• Operate content moderation and verification of the information shown on the platform.

3.2. Secondary purposes (optional)

The following purposes are not necessary to provide the service. You may object to these purposes without affecting the provision of the main service, by writing to [email protected] with the word "OPOSICIÓN" in the subject line:

• Send commercial communications, newsletters and promotions from Ubica Casa.
• Share statistical information and usage behavior with commercial allies and strategic partners for the development of services complementary to the real estate sector.
• Build usage and preference profiles to personalize editorial content, property recommendations and advertising on and off the platform.
• Invite you to market studies, surveys, focus groups and incentivized interviews.
• Share your contact information, the property you consulted or your declared profile with mortgage brokers, notaries, insurers or complementary-service allies when you express explicit interest in their service.
• Publish testimonials, success stories and content in marketing materials with prior express authorization.

4. Transfers and remittances

Ubica Casa may transfer and/or remit your personal data, without requiring your consent (article 37 of the LFPDPPP), to:

• Competent judicial and administrative authorities, when there is a duly founded and reasoned request in accordance with the law.
• Companies within the same corporate group as Ubica Casa that operate under the same privacy notice and internal processes.
• Tax and accounting professionals and authorities who require the information to comply with the Controller's legal obligations.

With your consent (by continuing to use the platform and/or by expressing explicit interest in a property or service), Ubica Casa may transfer your data to:

• Owners, landlords, real estate agents, agencies or developers with whom you start a conversation through the platform about a published property or service.
• Commercial allies (notaries, law firms, insurers, mortgage brokers, banks, regulated SOFOMES, appraisers) when you expressly request to be contacted by them.
• Providers of payment processing, electronic invoicing, transactional messaging, cloud hosting, web analytics, fraud prevention and customer support with whom Ubica Casa has entered into a remittance agreement under article 14 of the LFPDPPP Regulations.
• Potential acquirers, merged or spun-off entities of Ubica Casa in the context of corporate transactions, ensuring that the acquirer respects the terms of this Notice.

When we transfer data to recipients outside Mexico, we require the recipient to provide a level of protection equivalent to or greater than that afforded by the LFPDPPP, through contractual clauses, binding corporate rules or other recognized legal instruments.

5. Legal basis

The processing of your personal data is carried out under articles 6, 16 and 73 section XXIX-O of the Political Constitution of the United Mexican States; articles 1, 8, 9, 10, 11, 12, 16, 17, 18, 19, 36, 37 and others applicable of the Federal Law on the Protection of Personal Data Held by Private Parties; the relevant articles of its Regulations; the Privacy Notice Guidelines; the Commercial Code; the Federal Civil Code; the Federal Tax Code; the applicable provisions on e-commerce and the other regulations governing the services provided by Ubica Casa.

6. ARCO rights and procedure

As the owner of the personal data, you have the right at all times to:

• Access: know what personal data we hold about you and what we use it for.
• Rectification: request correction of inaccurate, incomplete or outdated data.
• Cancellation: request deletion of your data when you consider it is not required.
• Objection: object to processing for specific purposes.

To exercise any of these rights, send a request to [email protected]with the word "ARCO" in the subject line, including:

• Full name of the owner and the email where you will receive a reply.
• A document proving the identity or capacity of the representative (with valid power of attorney).
• A clear, precise description of the right you are exercising and the data it concerns.
• Any element or document that helps locate the data.

Ubica Casa will respond to your request within 20 business days of receipt. If the request is granted, it will take effect within an additional period of no more than 15 business days. Exercising ARCO rights is free; you need only cover justified shipping or reproduction costs for copies or other formats.

Please note that the request may be denied when: (i) the applicant is not the owner or representative; (ii) the applicant's personal data is not found in the database; (iii) it would harm the rights of a third party; (iv) there is a legal impediment or an authority's ruling; (v) the data has already been rectified, cancelled or the objection does not apply.

7. Withdrawal of consent

You may withdraw at any time the consent granted for the processing of your personal data, without retroactive effect. Withdrawal is requested through the same channel and procedure as ARCO requests. Withdrawing consent for primary purposes may prevent the provision of the main service.

8. Limiting use or disclosure

If you wish to limit the use or disclosure of your data for marketing or advertising purposes, you may register free of charge in the Public Consumer Registry (REPEP) run by the Federal Consumer Protection Agency, or request directly from Ubica Casa inclusion in our exclusion list, by emailing [email protected] with the word "LIMITAR" in the subject line.

9. Security measures

Ubica Casa implements administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction, unauthorized use, access or processing.

9.1. Administrative measures

Internal policies, periodic training of authorized staff, incident-response processes, information classification, role separation, confidentiality agreements with staff and providers, and remittance clauses with processors under article 14 of the LFPDPPP Regulations.

9.2. Technical measures

Encryption in transit (TLS), encryption at rest for sensitive fields, multi-factor authentication for privileged access, tokenization of identifiers, event monitoring, role-based access control, audit logging, encrypted backups, vulnerability management, periodic penetration testing and environment segregation (development, testing, production).

9.3. Physical measures

Hosting in data centers with physical access controls, perimeter monitoring, safekeeping of physical files in locked cabinets, visitor control at facilities and clean-desk policies.

10. Processing of minors' data

Ubica Casa's services are intended for adults. We do not intentionally collect data from people under 18. If we detect that we have received data from a minor without the consent of a parent or guardian, we will delete it without delay. If you believe a minor has provided us with data, contact us at [email protected].

11. Cookies, beacons and similar technologies

Ubica Casa uses first- and third-party cookies, web beacons, pixels, local storage and equivalent technologies for technical purposes (authentication, language, security), measurement (anonymized analytics), personalization (recommendations, recent searches) and advertising (showing relevant messages on and off the site).

Types of cookies used:

• Strictly necessary: essential for the site to work (session, security).
• Preference: remember your settings (language, city, views).
• Analytics: aggregate usage measurement (without identifying you personally).
• Marketing: personalization of communications and advertising.

You can manage cookie use from your browser settings. Disabling strictly necessary cookies may affect the proper functioning of the site.

12. Social media and third-party platforms

If you access the platform or interact with our content through social media, messaging apps or federated single sign-on (SSO) services, the information those platforms share with us is subject to their own policies and terms. We recommend you review those policies before using such services. Ubica Casa is not responsible for how those platforms process your data.

13. Retention periods

We retain your personal data for the time necessary to fulfill the purposes of processing and, where applicable, to address potential legal, accounting, tax or regulatory liabilities arising from the contractual relationship. In particular:

• Active account data: while your account is open and up to 5 years after its closure.
• Transactional and billing data: 5 years under the Federal Tax Code.
• Internal conversation logs: 24 months after the last activity in the conversation.
• Access and audit logs: 24 months for fraud detection and security.
• Contact data for commercial communications: until you request opt-out or object.

14. Breach notification

In the event of a security breach that significantly affects the financial or moral rights of data owners, Ubica Casa will notify the affected owner(s) through the registered email and, depending on severity, through any additional means it deems appropriate, within a reasonable period and in accordance with article 64 of the LFPDPPP Regulations.

15. Changes to the privacy notice

Ubica Casa may modify, supplement or update this Privacy Notice at any time due to legal, internal or best-practice changes. The current version is published at this same URL with the update date in the header. Substantive changes will be notified to the registered email. We recommend you review this Notice periodically.

16. Supervisory authority and contact

If you believe your right to personal data protection has been harmed by any conduct of Ubica Casa, or that there is an alleged violation of the LFPDPPP in the processing of your data, you may file a complaint or report with INAI (National Institute for Transparency, Access to Information and Personal Data Protection) at its offices or website www.inai.org.mx.

For any question, comment, exercise of rights or request related to this Notice, contact our Personal Data Department at:

• Email: [email protected]
• Suggested subject: "ARCO", "OPOSICIÓN", "REVOCACIÓN" or "LIMITAR" depending on the right exercised
• We operate 100% digitally: we have no phone support or offices open to the public