PRIVACY NOTICE

BANDPRICE, S.A. DE C.V. (“BANDPRICE”), with address at Av. Morelos 827, Edificio 14,  Departamento 204, Colonia Jardín Balbuena, Alcaldía Venustiano Carranza, Mexico City, C.P.  15900, is the party responsible for the processing of the personal data it collects, under the  Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de  Protección de Datos Personales en Posesión de los Particulares, the “LFPDPPP”). For purposes  of this privacy notice (the “Notice”), «data subject» means the individual to whom the personal  data relates, who is the User as defined in the Terms and Conditions of Use. 

Last updated: August 25, 2026.  

1. Who does this Notice apply to? 
This Notice applies to the processing of the personal data of: 
• Persons who visit www.thewarinchiapas.com and its subdomains. 
• Persons who play The War in Chiapas (the “Game”), including its demos and early access  versions. 
• Persons who take part in the official community channels (Discord, Patreon, social media). • Press, content creators and persons who request keys, press materials or interviews. 
• Persons who respond to surveys, take part in playtests or answer calls for participation  issued by the project. 
Processing carried out by third-party platforms (Steam, Discord, Patreon, Kickstarter and  YouTube, among others) is governed by their own notices and policies, over which BANDPRICE  has no control. 
 

2. Personal data we process 
Depending on how the data subject interacts with the project, BANDPRICE may process: 
• Identification and contact data: name or pseudonym, public username, email address  and, where applicable, country or region. 
• Delivery data: address, contact telephone number and directions, solely where the data  subject is to receive a physical reward arising from a crowdfunding campaign. 
• Community data: content that the data subject voluntarily posts on official channels  (messages, comments, images, fan art, bug reports, suggestions). 
• Technical and usage data: IP address, device identifier, operating system, hardware  specifications, language, approximate location inferred from the IP address, and  information on the use of the Game and of the website (sessions, progress, duration,  errors and crash reports).

• Participation data: responses to surveys, contact forms, submissions to calls for  participation and correspondence with the project team. 

Sensitive data. BANDPRICE does not collect or require sensitive personal data (including racial  or ethnic origin, health status, genetic information, religious, philosophical or moral beliefs,  union membership, political opinions or sexual preference). Data subjects are asked to refrain  from including data of this nature in messages, forms or community channels. Should any such  data be received incidentally, it will be deleted. 

Financial or asset data. BANDPRICE does not process payments directly. Transactions are  carried out through the distribution or crowdfunding platforms, which act as the parties  responsible for that data under their own notices. BANDPRICE learns only, where applicable,  the reward tier purchased and confirmation of the transaction. 

3. Purposes of the processing 

3.1. Necessary purposes. These are essential to the relationship with the data subject and do  not require additional consent: 
• Operating, maintaining and improving the Game and the website, and enabling their  functionalities. 
• Handling contact and support requests, bug reports and the exercise of rights. • Administering participation in playtests, surveys and calls for participation. 
• Managing the delivery of rewards and compliance with crowdfunding campaign  commitments. 
• Moderating the official community channels and enforcing the Terms and Conditions of  Use. 
• Preventing, detecting and addressing fraud, misuse, unauthorized distribution of the  Game and security incidents. 
• Complying with legal, accounting and tax obligations, and responding to requirements  from the competent authority. 
• Analyzing use of the Game on an aggregate basis in order to fix bugs and guide  development. 

​

3.2. Additional purposes. These are not necessary for the relationship with the data subject  and require the data subject’s consent: 
• Sending newsletters, development updates, playtest invitations and promotional  communications. 
• Publicly displaying the data subject’s name or pseudonym in the Game credits or in  project materials, where this has been offered as a reward.

• Publishing or reproducing testimonials, comments or material that the data subject sends  to BANDPRICE for the purpose of promoting the Game. 
• Compiling statistics and audience profiles for marketing purposes. 
 

Refusal. The data subject may refuse the processing of data for the additional purposes at  any time, without this affecting access to the Game or the handling of the data subject’s  requests. It is enough to send a message to the email address indicated in section 11, or to use  the unsubscribe link included in each electronic communication. 

4. Automatic collection of data 
The website and the Game use cookies, activity logs, analytics tools and automatic crash  reports in order to recognize the device, retain preferences, measure usage and detect errors.  The data subject may block or delete cookies through the browser settings, and disable the  sending of usage data through the Game options where that function is available. Disabling  them may prevent certain sections or functions from working properly. 

5. Minors 
Because of its subject matter, the Game and the official channels are aimed at an adult or  mature teenage audience and are not directed at children under thirteen. BANDPRICE does  not knowingly collect personal data from persons below that age. This threshold relates solely  to the processing of personal data and does not replace the access and acceptance rules set  out in the Terms and Conditions of Use, under which, where the user is a minor, acceptance  corresponds to the person holding parental authority or guardianship. Any person holding  parental authority or guardianship who becomes aware that a minor in their care has provided  personal data may request its deletion at the email address indicated in section 11, and it will  be deleted. 

6. Processors, transmissions and transfers 

6.1. BANDPRICE relies on suppliers that process personal data on its behalf and under its  instructions (processors), such as website hosting and building services, cloud storage, email  and newsletter services, analytics, community messaging and shipping logistics. These  transmissions do not require the data subject’s consent. 

6.2. BANDPRICE does not sell, rent or trade personal data. It discloses data to third parties only  where necessary to operate the project’s platforms, to comply with a legal obligation, to  respond to requirements from the competent authority acting within its powers, or to  establish, exercise or defend a right in a proceeding. Outside those cases, any transfer that  requires consent under the LFPDPPP will be carried out only with the data subject’s prior  authorization.

​

6.3. Processing outside Mexico. Several of the suppliers and platforms referred to above  operate servers outside Mexican territory, principally in the United States of America and the  European Union. Use of the website, of the Game and of the official channels means that data  may be stored and processed in those jurisdictions, subject to contractual confidentiality and  security undertakings. 

6.4. Transfer clause. Where a transfer requires the data subject’s consent under the LFPDPPP,  the data subject may express refusal by checking the box below at the time of providing their  data, or by sending a message at any time to the email address indicated in section 11: 

☐ I do not consent to my personal data being transferred to third parties in those cases that require  my consent. 

​

If no refusal is expressed once this Notice has been made available, consent to the transfers  described will be deemed granted. Refusal does not affect access to the Game or the handling  of the data subject’s requests, and the receiving third party will assume the same obligations  as those applicable to BANDPRICE. 

​

7. Retention period 
Data is retained only for as long as necessary to fulfill the purposes for which it was collected  and, thereafter, for the applicable legal, accounting and tax limitation periods. Once those  periods have elapsed, the data is deleted or subjected to a dissociation process. Data  processed on the basis of the data subject’s consent is removed from the relevant lists when  that consent is revoked. 

8. Security measures 
BANDPRICE has adopted reasonable administrative, technical and physical measures to  protect personal data against damage, loss, alteration, destruction, or unauthorized use,  access or processing, taking into account the existing risk, the potential consequences for data  subjects and the state of the art. Access is limited to the personnel and collaborators who  require it in the performance of their duties, subject to confidentiality obligations. 

9. ARCO rights, revocation and limitation of use 

9.1. The data subject may at any time access their personal data, rectify it where it is inaccurate  or incomplete, cancel it where they consider that it is not required for any of the stated  purposes, and object to its processing for specific purposes (ARCO rights: access,  rectification, cancellation and objection). The data subject may also revoke any consent given  and limit the use or disclosure of their data. 

9.2. How to exercise them. By a request sent to thewarinchiapas@gmail.com, with the  subject line “Derechos ARCO”, containing: (i) the data subject’s name and a means of 

communicating the response; (ii) a copy of official identification and, where applicable, of the  document evidencing representation; (iii) a clear description of the data in respect of which  the right is exercised and of the right the data subject intends to exercise; and (iv) any element  that helps locate the data. 

9.3. Time limits and cost. The exercise of these rights is free of charge; only justified shipping  or reproduction costs may be charged. BANDPRICE will communicate the determination  adopted within twenty days following receipt of the request and, where the request is granted,  will give effect to it within fifteen days following the date on which the response is  communicated, in accordance with the LFPDPPP. These periods may be extended once for an  equal period where the circumstances of the case so warrant. 

9.4. Limits. Cancellation or objection may not be available where the law so prevents, where  the data is necessary to comply with a legal obligation, or where it would obstruct judicial or  administrative proceedings connected with tax obligations, the investigation of offenses or the  enforcement of administrative penalties. Where applicable, the response will explain the  reason. 

9.5. Limitation of use or disclosure. In addition to the mechanisms above, the data subject  may request to be added to BANDPRICE’s exclusion list, through the same email address, in  order to stop receiving promotional communications. 

10. Changes to this Notice 
BANDPRICE may amend this Notice to address legislative developments, internal policies or  new project requirements. The version in force will always be available at  www.thewarinchiapas.com, stating its last-updated date. In the case of substantial changes to  the purposes of the processing, notice will be given by email to the data subjects whose  contact details BANDPRICE holds, or by a prominent notice on the website. 

11. Contact and authority 
Personal data department: thewarinchiapas@gmail.com, at the address indicated at the  beginning of this Notice. Questions, ARCO requests, revocations and complaints relating to the  processing of personal data are handled there. 
If the data subject considers that their right to the protection of personal data has been  infringed, or suspects a breach of the LFPDPPP, they may turn to the Ministry of Anti Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the authority  competent in this area following the dissolution of INAI. 

12. Consent

By providing personal data to BANDPRICE through any of the means indicated, and by not  expressing objection once this Notice has been made available, the data subject consents to  its processing on the terms described herein.