Privacy Policy and Personal Data Processing

1. The controller responsible for the processing of personal data collected through the THE10MDG game and the site the10milliondollargame.com is TUNEGOCIO IA S.A.S, a company duly organized under the laws of Colombia, identified with Tax ID (NIT) 902.061.281, domiciled in Barranquilla, Republic of Colombia (the "Operator").
2. Contact channel for personal data matters: yeibers+atencion@tunegocioia.app.
3. This Policy is issued in compliance with Colombian Law 1581 of 2012 ("Ley 1581 de 2012," Colombia's Data Protection Statutory Law), Decree 1377 of 2013 ("Decreto 1377 de 2013"), and any rules amending or supplementing them, and forms an integral part of the Game's Terms and Conditions.

For purposes of this Policy, the legal definitions of Law 1581 of 2012 apply, including in particular:

Personal Data

Any information linked to, or that may be associated with, an identified or identifiable natural person.

Data Subject

The natural person whose data is processed (the Player).

Processing

Any operation performed on personal data, such as collection, storage, use, circulation, or deletion.

Authorization

The Data Subject's prior, express, and informed consent.

Data Processor (Encargado)

The party that processes data on behalf of the Data Controller.

1. Account Data: email address, username, password (stored in encrypted, irreversible form by our authentication provider), account creation date, language, and country inferred from the connection.
2. Payment Data: transaction reference, purchased package, amount, currency, payment status, and the transaction identifier assigned by the payment gateway. The Operator does not collect, store, or have access to the Data Subject's card numbers, security codes, or financial credentials, which are handled directly and exclusively by the Wompi payment gateway under its own policies and certifications.
3. Technical Game Data (Competitive Integrity Log): all inputs (keystrokes and taps) of each Match with their timestamps; technical session metrics and gameplay behavior; server-side data arrival times; browser and device technical characteristics relevant to automation detection; risk events; and cryptographic progress logs. This data is inherent to the operation of the Game and to the legitimacy of the competition.
4. Referral Program Data: referral code, the relationship between referring and referred accounts, and bonuses earned.
5. Winner Verification Data (winners only): identity document, full name, and the recording of the video verification session described in the Terms and Conditions, including the Data Subject's image and voice during that session.
6. Contact and Support Data: communications the Data Subject sends to the Operator and the data contained therein.
7. Browsing Data: IP address, browser user agent, and technical access logs, for security and service operation purposes.
8. Anti-Fraud Technical Fingerprints: device identifiers and IP addresses associated with registration and purchases, always stored as irreversible hashes and never in plain text, for the sole purpose of detecting and preventing fraudulent use of the referral program.

Personal data will be processed for the following purposes:

1. To create, administer, and authenticate the Data Subject's Account, and to enable access to and use of the Game.
2. To process the purchase of Trips, credit purchases confirmed by the payment gateway, administer the referral program, and maintain accounting records of transactions.
3. To ensure the competitive integrity of the Game: to technically and cryptographically verify progress and wins; to detect, investigate, and sanction the use of automation, manipulation, or any prohibited conduct; and to preserve evidentiary support for decisions made. The Data Subject acknowledges that this purpose is essential to the nature of the Game: without the permanent record of gameplay inputs and metrics, the competition for cash prizes would lack verifiable legitimacy.
4. To carry out the winner verification process, including identity validation and the video session, and to retain its supporting records.
5. To pay prizes, apply any withholdings required by law, and comply with the Operator's tax, accounting, and legal obligations.
6. To send transactional and service communications (email verification, password recovery, purchase confirmations, and notices regarding the status of the Game and the Rounds).
7. To publish the username of verified winners in the Game's public transparency registry.
8. To address petitions, complaints, and claims, and to exercise or defend the Operator's rights.
9. To prepare aggregated and anonymized statistics and analysis on Game usage that do not allow individual Data Subjects to be identified.
10. To prevent and detect fraud in the referral program by matching technical fingerprints stored as hashes, for the sole purpose of identifying self-referrals and accounts created artificially to generate referral trips.
11. Data will not be used for third-party advertising purposes or sold to third parties.

1. Authorization for processing is obtained at the time of registration, through express acceptance of this Policy and the Terms and Conditions, and is recorded in the system's logs.
2. For processing winner verification data (identity document and video recording), specific authorization will be obtained at the start of the verification process.
3. Authorization is not required in the cases exempted under Article 10 of Law 1581 of 2012, including information requested by a competent authority in the exercise of its functions.

1. To operate the Game, the Operator relies on technology providers acting as data processors or as independent controllers within their respective scopes, including: Supabase (authentication and database), Fly.io (verification server infrastructure), Cloudflare (domain and network management), Wompi — Bancolombia (payment processing), and Resend (transactional email delivery).
2. These providers may store or process data on servers located outside Colombia, primarily in the United States of America. By accepting this Policy, the Data Subject expressly authorizes the international transfer and transmission of their data to these providers, exclusively for the purposes described herein. The Operator requires its providers to maintain security and confidentiality standards consistent with the nature of the data.
3. The Operator does not assign, sell, or share personal data with third parties for commercial or advertising purposes unrelated to the Game.

Pursuant to Article 8 of Law 1581 of 2012, the Data Subject has the right to:

1. Know, update, and correct their personal data held by the Operator.
2. Request proof of the authorization granted.
3. Be informed, upon request, of the use given to their data.
4. File complaints with the Superintendencia de Industria y Comercio (Colombia's data protection and consumer protection authority, "SIC") for violations of data protection regulations, after exhausting the consultation or claim process before the Operator.
5. Revoke authorization and/or request deletion of their data when there is no legal or contractual obligation requiring its retention. The Data Subject should note that: (a) deletion of Account data entails the inability to continue participating in the Game; and (b) technical competitive integrity records associated with Matches, wins, payments, and decisions already made may be retained as evidentiary and accounting support under Section 9, in accordance with applicable legal exceptions.
6. Access their personal data being processed free of charge.

1. Inquiries regarding personal data may be submitted to yeibers+atencion@tunegocioia.app and will be addressed within a maximum of ten (10) business days from receipt, extendable by five (5) additional business days with notice to the Data Subject, pursuant to Article 14 of Law 1581 of 2012.
2. Claims (correction, update, deletion, or alleged non-compliance) must include the Data Subject's identification, a description of the facts, a contact address, and any supporting documents. They will be addressed within a maximum of fifteen (15) business days, extendable by eight (8) additional business days with notice to the Data Subject, pursuant to Article 15 of Law 1581 of 2012.
3. If a claim is incomplete, the requesting party will be asked to complete it within five (5) days; if two (2) months pass without a response, the claim will be deemed withdrawn.

1. Account data is retained while the Account remains active and, after closure, for the period necessary to comply with legal obligations and defend against potential claims.
2. Payment and prize records are retained for the periods required under Colombian accounting and tax regulations.
3. Technical competitive integrity records (inputs, metrics, verifications) associated with wins, prizes, sanctions, or Operator decisions are retained as evidentiary support for such decisions for as long as they may be subject to dispute and for the applicable legal statute-of-limitations periods.
4. The recording of a winner's verification session is retained as support for the approval or rejection decision, for the statute-of-limitations period applicable to claims arising from the prize.
5. Once the above periods have elapsed, data will be securely deleted or anonymized.

1. The Operator adopts reasonable technical, human, and administrative measures to protect personal data, including: encryption of communications (HTTPS/TLS), password management through irreversible cryptographic mechanisms handled by the authentication provider, restricted access control to systems, cryptographic signature verification in communications with the payment gateway, security event logging, and environment separation.
2. No system is infallible. In the event of a security incident affecting personal data, the Operator will adopt the containment and notification measures required by law and by the instructions of the Superintendencia de Industria y Comercio (SIC).

1. The Game is directed exclusively at persons eighteen (18) years of age or older. The Operator does not knowingly collect data from minors. If it becomes aware that a minor has created an Account, the Account will be closed and the data deleted, except for the minimum records necessary to support such closure.

1. The Site uses strictly functional cookies and local storage necessary for session authentication, security, and operation of the Game. No third-party advertising cookies are used. The Data Subject may manage cookies through their browser, understanding that blocking them may prevent the Game from functioning.

1. The Operator may amend this Policy at any time. Amendments will be published on the Site along with their effective date. Where substantial changes to the purposes of processing are involved, Data Subjects will be notified through their registered contact channels, and new authorization will be requested if required.

1. This Policy is effective upon publication. Databases will be retained for the periods indicated in Section 9 or as otherwise required by law.