1. Introduction

LA SURTIDORA INC. —hereinafter, “La Surtidora,” “we,” “us,” “our,” or the “Company”— respects the privacy of its customers, participants, visitors, and users.

This Privacy Policy describes how we collect, use, retain, protect, and, where applicable, disclose personal information obtained through:

• our website;
• registration forms;
• QR codes;
• promotions and coupons;
• electronic communications;
• customer service requests;
• promotion validation systems;
• point-of-sale systems related to coupon redemption;
• other digital or in-person channels administered by La Surtidora.

This Policy also explains the rights California residents may have regarding their personal information under applicable law.

The California Online Privacy Protection Act requires operators of commercial websites that collect information from California consumers to conspicuously post a privacy policy.

This Policy should be read together with the Terms and Conditions applicable to the website, the Promotion, and any specific program offered by La Surtidora.

2. Entity Responsible for Information Processing

The entity responsible for the practices described in this Policy is:

LA SURTIDORA INC
12125 Day St., Bldg. W
Moreno Valley, CA 92557
United States of America

Email: info@lasurtidorainc.com
Phone: (951) 981-4652
Website: https://lasurtidorainc.com

3. Summary of Privacy Rights for California Residents

When La Surtidora is subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act —collectively, the “CCPA/CPRA”— California residents may have, as applicable, rights relating to:

• knowing the categories of personal information collected;
• requesting access to specific pieces of personal information;
• requesting correction of inaccurate personal information;
• requesting deletion of personal information;
• knowing the purposes for which the information is used;
• knowing the categories of third parties to whom information is disclosed;
• requesting to opt out of the sale or sharing of personal information, where applicable;
• limiting certain uses or disclosures of sensitive personal information, where applicable;
• receiving information in a portable format when required by law;
• not receiving discriminatory treatment for exercising privacy rights.

Requests may be submitted using the methods described in the “How to Exercise Your Privacy Rights” section of this Policy.

Application of the CCPA/CPRA depends on whether a business meets certain legal criteria established by current law. Those criteria and thresholds may change periodically. For that reason, this Policy does not incorporate a fixed revenue amount or consumer-volume threshold as a permanent condition of applicability.

4. Notice at Collection

When La Surtidora collects personal information through a form, QR code, registration page, service request, or other direct mechanism, it will provide, when required by applicable law, a conspicuous notice at or before the time of collection.

That notice will identify, in a reasonably clear manner:

• the categories of personal information to be collected;
• the primary purposes for which the information will be used;
• whether the information is sold or shared, as those terms are defined under the CCPA/CPRA;
• the retention period or the criteria used to determine it;
• a link to this Privacy Policy;
• any additional notice required by law.

The Notice at Collection applicable to the promotional form is included at the end of this Policy and should be displayed directly with the registration form.

California law requires that the notice be provided at or before the time personal information is collected and that it identify the applicable categories and purposes.

5. Categories of Personal Information We May Collect

The information we collect depends on how a person interacts with La Surtidora.

Category Table

6. Information You Provide Directly

We may collect personal information when you:

• complete a Promotion registration form;
• scan a QR code;
• request or receive a coupon;
• voluntarily provide your telephone number;
• agree to receive promotional communications;
• contact customer service;
• submit a claim;
• request to exercise privacy rights;
• provide documentation to verify identity or eligibility;
• participate in surveys, promotions, or authorized programs;
• communicate with us by email, telephone, or digital means.

On the promotional form, we may request:

• first name;
• last name;
• email address;
• ZIP code;
• optional telephone number;
• acceptance of the Terms and Conditions;
• acknowledgment of access to this Policy;
• separate marketing consent, when the user chooses to provide it.

7. Information Collected Automatically

When a person uses our website, form, or promotional platform, we may automatically collect limited technical information, including:

• IP address;
• date and time of access;
• browser used;
• operating system;
• general device type;
• pages visited;
• technical errors;
• session identifiers;
• validation logs;
• information about coupon use or redemption;
• cookies or similar technologies;
• data reasonably necessary for security, auditing, and fraud prevention.

We may use this information to:

• maintain site security;
• detect automated access;
• prevent duplicate registrations;
• prevent repeated use of a coupon;
• diagnose errors;
• maintain audit records;
• protect our systems;
• analyze the overall operation of the Promotion.

We will not use technical mechanisms in an arbitrary or discriminatory manner.

8. Sources of Personal Information

We may obtain personal information from the following sources:

• Directly from the consumer, when the consumer completes a form, registers, presents a coupon, or communicates with us.
• Automatically from the device or browser, through technical logs, cookies, IP addresses, and similar technologies.
• From our point-of-sale systems, when a coupon is validated or redeemed.
• From service providers, when they provide hosting, email, security, storage, support, technical analytics, or form-administration services.
• From authorized La Surtidora personnel, when they respond to an inquiry, verify an issue, or document a claim.
• From authorities or legally authorized sources, when necessary to comply with legal obligations or investigate unlawful activity.

9. Purposes for Which We Use Information

We may use personal information for:

9.1 Promotion Administration

• registering participants;
• verifying eligibility requirements;
• generating and issuing coupons;
• sending operational confirmations;
• validating codes;
• preventing duplicate redemptions;
• recording coupon use;
• addressing issues related to the Promotion.

9.2 Fraud Prevention and Security

• detecting repeated registrations;
• identifying automation, bots, or scripts;
• investigating alterations or counterfeiting;
• protecting our systems;
• preventing unauthorized access;
• preserving records related to incidents;
• applying restrictions when objective and verifiable evidence of abuse exists.

9.3 Customer Service

• responding to inquiries;
• processing claims;
• investigating technical problems;
• verifying the authenticity of a participation;
• communicating with the customer;
• providing assistance.

9.4 Legal Compliance

• complying with laws, regulations, and valid orders;
• responding to competent authorities;
• retaining required records;
• handling privacy requests;
• asserting or defending legal claims;
• documenting consent and electronic acceptance.

9.5 Operation and Improvement of Our Services

• maintaining the website;
• diagnosing failures;
• improving the registration experience;
• analyzing technical performance;
• verifying the operational effectiveness of promotions;
• protecting the integrity of our systems.

9.6 Promotional Communications

When a person provides separate and optional consent, we may use the person’s information to send:

• promotions;
• offers;
• news and updates;
• events;
• information about products or services.

Declining marketing communications will not prevent a person from registering for, receiving, or using the coupon, provided that the other requirements of the Promotion are met.

10. Basis and Proportionality of Processing

La Surtidora will seek to collect and use only the information that is reasonably necessary and proportionate to:

• manage the consumer relationship;
• administer the Promotion;
• protect security;
• prevent fraud;
• comply with legal obligations;
• respond to requests;
• achieve the purposes disclosed at the time of collection.

We will not use personal information for a purpose that is materially incompatible with the disclosed purpose unless we provide additional notice and obtain consent when required by law.

11. Sensitive Personal Information

The CPRA recognizes a specific category of sensitive personal information.

For ordinary registration and administration of the promotional coupon, La Surtidora does not request:

• Social Security number;
• driver’s license or passport;
• financial account credentials;
• payment card numbers;
• precise geolocation;
• biometric information;
• private contents of communications;
• genetic information;
• health data;
• racial or ethnic origin;
• religious beliefs;
• sexual orientation;
• citizenship or immigration status.

La Surtidora does not collect or use sensitive personal information for purposes that give rise to additional rights to limit use under the CPRA, unless expressly stated otherwise through a specific notice.

In exceptional circumstances, we may request identity documentation to verify a claim, investigate fraud, or respond to a rights request. In that event:

• only what is reasonably necessary will be requested;
• the purpose will be disclosed;
• access will be limited;
• the information will be retained for the necessary period;
• the information will be deleted or deidentified when no longer needed, subject to applicable legal obligations.

12. Sale and Sharing of Personal Information

For purposes of the CCPA/CPRA:

La Surtidora does not sell personal information collected through the promotional coupon registration form.

La Surtidora also does not use information collected through that form to share it with third parties for cross-context behavioral advertising.

La Surtidora does not sell personal information to third parties for monetary or other valuable consideration, as the term “sale” is defined under the CCPA/CPRA.

This statement depends on the actual technology practices used on our websites and platforms. If we implement tools in the future that involve the sale or sharing of information under applicable legal definitions, we will update this Policy, provide the required notices, and enable the applicable opt-out mechanisms.

Analytics or advertising tools that may require additional evaluation include, among others:

• Google Analytics advertising features;
• Meta Pixel;
• TikTok Pixel;
• remarketing cookies;
• advertising SDK;
• tracking technologies across different websites or services.

La Surtidora evaluates the cookies, pixels, analytics tools, and other technologies used on its websites to determine whether they involve a sale or sharing of personal information under applicable law. Information about the technologies actually used is described in the Cookies and Similar Technologies section.

13. Cookies and Similar Technologies

We may use cookies and similar technologies to:

• maintain sessions;
• remember preferences;
• protect the form;
• detect automated activity;
• measure technical performance;
• prevent fraud;
• improve site operation.

Cookies may be:

13.1 Essential

Necessary for:

• security;
• operation;
• session management;
• form validation;
• duplicate prevention.

13.2 Functional

Used to remember:

• language;
• preferences;
• experience settings.

13.3 Analytics

Used to understand site performance, always subject to the configuration of the tools used and applicable law.

13.4 Advertising

Advertising cookies should not be used for cross-context behavioral advertising without the disclosures, choices, and mechanisms required by applicable law.

Users may configure their browsers to reject certain cookies. However, disabling essential cookies may affect form operation or coupon validation.

14. Operational and Promotional Communications

14.1 Operational Communications

We may send communications necessary to:

• confirm registration;
• deliver the coupon;
• provide information about its status;
• respond to inquiries;
• communicate security incidents;
• respond to requests;
• provide legal notices.

These communications are not considered marketing when their primary purpose is to administer participation or comply with legal obligations.

14.2 Promotional Communications

We will send promotional communications only when there is separate, clear, and optional consent.

Marketing consent:

• is not required to participate;
• must not be preselected;
• may be withdrawn at any time;
• must be distinguished from acceptance of the Terms;
• must respect the communication channel authorized by the consumer.

For commercial email, La Surtidora will seek to comply with the CAN-SPAM Act.

For SMS or MMS messages, La Surtidora will seek to obtain the consent required under the Telephone Consumer Protection Act and other applicable rules.

Message and data rates charged by the wireless carrier may apply.

15. How We Share or Disclose Information

We may disclose personal information to the following categories of recipients:

15.1 Service Providers and Contractors

We may use providers for:

• web hosting;
• form administration;
• email delivery;
• storage;
• telecommunications;
• technical support;
• cybersecurity;
• fraud prevention;
• point-of-sale systems;
• audits;
• legal, tax, or professional advice.

Service providers and contractors are prohibited from retaining, using, or disclosing personal information for purposes other than providing the contracted services or as otherwise permitted by applicable law.

When required by applicable law, La Surtidora enters into agreements with its service providers and contractors that limit authorized purposes, prohibit unauthorized sale or sharing, and establish obligations regarding security, assistance, deletion, or return of information.

15.2 Authorities and Legal Compliance

We may disclose information when reasonably necessary to:

• comply with laws or regulations;
• respond to a court order;
• comply with a subpoena;
• respond to a valid legal request;
• cooperate with authorities;
• investigate unlawful activity;
• protect rights or safety.

15.3 Corporate Transactions

Information may be transferred as part of:

• a merger;
• acquisition;
• reorganization;
• financing;
• sale of assets;
• business succession.

In such cases, the information will remain subject to applicable legal obligations, and additional notices will be provided when required.

16. Information Retention

La Surtidora will retain personal information only for as long as reasonably necessary and proportionate to fulfill the disclosed purposes.

Retention criteria may include:

• the duration of the Promotion;
• the coupon validation period;
• the time needed to resolve claims;
• fraud prevention;
• audits;
• tax, accounting, or regulatory obligations;
• applicable statutes of limitations for potential claims;
• security and the defense of legal rights.

General Retention Table

Retention periods are implemented through administrative and technical procedures designed to delete, deidentify, or aggregate information when it is no longer reasonably necessary.

La Surtidora will not retain information solely because of the indefinite possibility that it may be useful in the future.

17. Information Security

La Surtidora maintains reasonable administrative, technical, physical, and organizational safeguards appropriate to:

• the nature of the information;
• the volume of data;
• foreseeable risks;
• the systems used;
• the context of the processing.

These safeguards may include access controls, credential management, backup procedures, internal restrictions, activity logs, training, and technological security mechanisms, to the extent such controls are actually implemented.

No transmission, storage, or processing system can guarantee absolute security.

Users must also protect their devices, accounts, passwords, promotional codes, and email accounts against unauthorized access.

18. Security Incidents

If La Surtidora detects a security incident, it may:

• investigate its scope;
• contain the incident;
• preserve evidence;
• restore systems;
• evaluate affected information;
• notify providers or authorities, where appropriate;
• adopt corrective measures.

If an incident results in unauthorized access to personal information and applicable law requires notification, we will provide the applicable notices in accordance with current law.

California law requires notification to affected residents when certain types of unencrypted personal information have been acquired, or are reasonably believed to have been acquired, by an unauthorized person. When a single breach requires notification to more than 500 California residents, a sample copy of the notice must also be submitted to the California Attorney General.

19. Children’s Privacy

The coupon Promotion is not directed to individuals under eighteen (18) years of age.

We do not knowingly collect personal information through the promotional form from individuals under eighteen years of age.

Our website and services are not designed to knowingly collect personal information from children under thirteen (13) years of age.

If we learn that we have collected personal information from a child under thirteen without the required authorization, we will take reasonable steps to delete it.

COPPA may apply to websites directed to children under 13 and to general-audience websites that have actual knowledge that they are collecting personal information from children under that age.

A parent or guardian who believes that a minor provided information to us may contact us through the channels listed in this Policy.

20. Financial Incentives, Promotions, and Coupons

La Surtidora may offer coupons, discounts, promotions, loyalty programs, or other benefits.

Participation in a Promotion does not automatically constitute a regulated financial incentive in exchange for personal information unless:

• the benefit is related to the collection, retention, sale, or sharing of personal information;
• it is structured as a difference in price or level of service based on the value of the data;
• applicable law treats it as a financial incentive.

The 5% registration coupon is offered as a commercial Promotion subject to its Terms and Conditions and is not offered in exchange for authorizing the sale or sharing of personal information.

The participant is not required to agree to marketing communications to obtain or use the coupon.

If a future Promotion constitutes a financial incentive under the CCPA/CPRA, La Surtidora will first provide a separate notice explaining:

• the material terms;
• the nature of the benefit;
• the categories of information involved;
• the reasonable relationship between the benefit and the estimated value of the information;
• the method for opting in;
• the right to withdraw;
• any other required disclosure.

California law permits certain discount, reward, and benefit programs, but establishes additional requirements when they constitute financial incentives tied to personal data, including notice and prior consent where applicable.

21. California Privacy Rights

When applicable, a California resident may request:

21.1 Right to Know

Information about:

• categories collected;
• sources;
• purposes;
• categories sold or shared;
• categories disclosed;
• categories of recipients;
• specific pieces of information.

21.2 Right of Access

A copy of certain personal information maintained by La Surtidora.

21.3 Right to Correct

Correction of inaccurate personal information, taking into account the nature of the information and the purposes of processing.

21.4 Right to Delete

Deletion of personal information, subject to legal exceptions, including when retention is necessary to:

• complete a transaction;
• prevent fraud;
• detect incidents;
• comply with legal obligations;
• exercise rights;
• maintain compatible internal uses permitted by law.

21.5 Right to Data Portability

Receipt of certain information in a reasonably portable and technically feasible format when required by law.

21.6 Right to Opt Out of Sale or Sharing

When La Surtidora sells or shares information under applicable definitions, the consumer may request to opt out.

La Surtidora currently does not sell or share for cross-context behavioral advertising the information collected through the promotional form.

21.7 Right to Limit the Use of Sensitive Information

When La Surtidora uses sensitive personal information for purposes that give rise to this right, the consumer may request the applicable limitation.

The promotional form is not currently designed to collect or use sensitive information for those purposes.

21.8 Right to Non-Discrimination

We will not deny goods or services, charge discriminatory prices, or provide a different level of service because a person exercised privacy rights, except where a difference is permitted by law.

22. How to Exercise Your Rights

You may submit a request through:

Email: info@lasurtidorainc.com
Phone: (951) 981-4652
Postal mail:

LA SURTIDORA INC
Attn: Privacy Request
12125 Day St., Bldg. W
Moreno Valley, CA 92557

When possible, include:

• full name;
• email address;
• telephone number, when applicable;
• type of request;
• relationship with La Surtidora;
• sufficient information to locate the records;
• state of residence;
• any information necessary to reasonably verify identity.

Do not include unnecessary sensitive information.

23. Verification of Requests

To protect personal information, La Surtidora will reasonably verify identity before responding to certain requests.

Verification may consider:

• the email address used for registration;
• coupon information;
• contact information;
• approximate date of participation;
• the relevant store;
• other information that reasonably matches our records.

La Surtidora will not request more information than necessary to verify the request.

We may deny or limit a request when:

• we cannot reasonably verify identity;
• a legal exception applies;
• the request is manifestly unfounded or excessive;
• responding would compromise another person’s privacy or security;
• the information must be retained by law.

Where applicable, we will explain the reason for the decision.

24. Authorized Agents

A California resident may use an authorized agent to submit certain requests.

We may request:

• written proof of authorization;
• direct verification of the consumer’s identity;
• direct confirmation that the consumer authorized the agent;
• power-of-attorney documentation, where applicable.

Information submitted by the agent will be used only to process and verify the request.

25. Response Timeframes

La Surtidora will acknowledge receipt of a request within the timeframes established by applicable law. A verifiable request will be addressed within forty-five (45) calendar days after receipt. When reasonably necessary, this period may be extended once for up to an additional forty-five (45) calendar days, provided that the requester is informed within the initial period and the reason for the extension is explained.

26. Preference Signals and Privacy Controls

When applicable law requires recognition of valid opt-out preference signals, La Surtidora will seek to process them in accordance with current law and the technological configuration of the website.

If the website does not sell or share information for cross-context behavioral advertising, receipt of a signal may not produce visible changes to the service.

Some browsers allow users to transmit a “Do Not Track” signal. There is currently no universal standard for interpreting all such signals. La Surtidora does not respond uniformly to Do Not Track signals that do not constitute a valid opt-out preference signal required by applicable law. Where applicable, La Surtidora will recognize valid Global Privacy Control signals or equivalent mechanisms required by current law.

27. Third-Party Links and Services

Our website may contain links to:

• social media;
• maps;
• third-party services;
• external platforms;
• provider websites.

La Surtidora does not control the privacy practices of independent websites.

Users should review each third party’s privacy policy before providing information.

The inclusion of a link does not mean that La Surtidora controls or is responsible for the third party’s practices.

28. Transfers and Storage

Information may be processed or stored by providers located in the United States or other jurisdictions where those providers operate.

When we use providers, we will seek to implement reasonable contractual and administrative protections in accordance with applicable law.

29. Changes to This Policy

We may update this Policy to reflect:

• legal changes;
• new technologies;
• changes to our practices;
• new promotions;
• changes in providers;
• regulatory requirements;
• clarity improvements.

When a change is material, we may communicate it through:

• the website;
• the form;
• email;
• a conspicuous notice;
• other appropriate channels.

The “Last Updated” date will indicate when the Policy was most recently revised.

Changes will not be applied retroactively in a manner inconsistent with applicable law.

30. Accessibility

La Surtidora seeks to make this Policy clear and accessible.

If you need this Privacy Policy:

• in an alternative format;
• with reading assistance;
• in an accessible format;
• in another available language;

you may contact us using the information provided in the Contact section.

We will seek to provide a reasonably accessible alternative.

31. Spanish and English Versions

This Policy may be published in Spanish and English.

Both versions should communicate substantially:

• the same practices;
• the same categories;
• the same purposes;
• the same rights;
• the same limitations.

If a material inconsistency exists, the interpretation required by applicable law and, where applicable, the interpretation most favorable to the consumer will apply.

32. Contact

For questions about this Policy or our privacy practices:

LA SURTIDORA INC
Attn: Privacy
12125 Day St., Bldg. W
Moreno Valley, CA 92557

Email: info@lasurtidorainc.com
Phone: (951) 981-4652
Website: https://lasurtidorainc.com

Business hours:
Monday through Friday, 8:00 a.m. to 4:00 p.m. Pacific Time, except applicable holidays.

NOTICE AT COLLECTION FOR CALIFORNIA RESIDENTS

Notice at Collection of Personal Information

La Surtidora collects personal information when you complete this form.

The categories we may collect include:

• identifiers, such as first name, last name, email address, ZIP code, and optional telephone number;
• technical information, such as IP address, date and time, browser, device, and security logs;
• limited commercial information, such as registration for the Promotion, coupon identifier, validation status, and redemption;
• information you voluntarily provide when communicating with us.

We use this information to:

• register your participation;
• verify eligibility;
• issue and validate the coupon;
• prevent duplicate registrations or redemptions;
• prevent fraud and abuse;
• respond to inquiries or claims;
• maintain administrative and audit records;
• comply with legal obligations;
• send promotional communications only when you provide separate and optional consent.

La Surtidora does not sell the personal information collected through this form and does not share it for cross-context behavioral advertising.

The information will be retained only for the period reasonably necessary and proportionate to administer the Promotion, validate the coupon, prevent fraud, resolve claims, comply with legal obligations, and protect our rights.