Privacy Policy

Bald Business LLC, doing business as EPIC ("EPIC," "we," "us," or "our"), operates EPIC Retreats Cabo.

This Policy describes how we handle personal information in connection with the Cabo website, including

its Webflow draft and production replacement displaying this Policy, application and waitlist forms,

registration, payments, retreat planning, attendance, communications, and associated resources.

This Policy is a notice of our practices. Reading it, visiting a website, or buying a seat does not by itself

give consent to every use described here. We request separate consent where required. The Terms of

Service govern purchases and participation; this Policy does not waive your privacy rights.

1. Who is responsible and how to contact us

Bald Business LLC is responsible for the personal information it determines how and why to process for

EPIC Cabo. Vic Keller and authorized EPIC personnel handle information on behalf of the company.

References to the EPIC brand do not mean that information is automatically available to every business

associated with Vic Keller.

Privacy contact: info@vickeller.com

Mail: Bald Business LLC, DBA EPIC, Attn: Privacy

2600 E Southlake Blvd, Ste 120-306

Southlake, TX 76092, United States

You may contact us with a question, request, complaint, or consent withdrawal. Identify EPIC Cabo in your

message so we can route it correctly. Do not include payment credentials, a passport copy, or medical

records in an initial request. We will explain any additional verification or secure submission step that is

necessary.

2. Information we collect and where it comes from

We collect information directly from you, automatically through the website and communications, and from

providers or other people supporting a requested service. Not every category is collected from every

person. Information about a business may also be personal information when it identifies an owner,

employee, or other individual.

Contact and identification information. This includes your name, email, phone number, mailing or billing

address, company, job title, and contact preferences. Sources include you, a purchaser registering you

with permission, scheduling services, and a person making an introduction. We use it to respond, identify

your application or Order, coordinate participation, and communicate in accordance with your choices.

Application and professional information. This includes business type, revenue ranges, team size,

professional background, goals, readiness to travel, questionnaire answers, and information you share in

application conversations. We use it to assess fit, review applications, tailor the retreat, and prepare

discussions. Public professional information and a permitted referral may supplement what you submit. Do

not provide customer records, employee records, or trade secrets unless specifically needed and lawfully

authorized.

Purchase and account records. This includes Orders, amounts, payment status, invoices, transaction

identifiers, billing details, refund or dispute correspondence, access records, and accepted agreementversions. Payment providers process card or bank credentials through their systems. EPIC's ordinary

business records contain transaction and limited payment details, not full card numbers or card security

codes. Do not send such credentials through ordinary forms or email.

Event logistics and preferences. This includes attendance, requested arrival coordination, guest details

provided with permission, emergency contacts, meal preferences, and accessibility requests. Health,

allergy, disability, dietary, or religious information you choose to provide may be sensitive under applicable

law. We request only what is reasonably needed for the particular arrangement, obtain required consent,

and limit disclosure to personnel and providers who need it. You may discuss a request privately instead

of posting it in a group.

Communications, content, and media. This includes support messages, emails, application conversations,

survey responses, group posts, documents you share, photographs, audio, video, and transcripts of

sessions that are recorded with required notice and consent. A private business conversation may contain

sensitive personal or confidential business information. Recording and publicity uses are addressed in

Section 7.

Device, internet, and usage information. This includes IP address, browser and device type, operating

system, approximate location inferred from an IP address, referring pages, pages viewed, link clicks,

dates and times, cookie identifiers, and interaction with forms, embedded media, or email. Providers may

collect this information through cookies, pixels, logs, or similar technologies. We do not need precise GPS

location to run an ordinary Cabo application.

Preferences and inferences. We may use application responses and interactions to understand program

interests, likely suitability, and communication preferences. These are estimates and may be incorrect.

You may ask us to correct relevant information or have an application reviewed by a person.

Information about others. If you give us another person's information, do so only with authority and direct

them to this Policy. Do not submit children's information. We do not require government ID copies,

biometric identifiers, detailed medical histories, or personal financial account credentials through general

application forms. If a provider needs travel documents or another special category, it should give the

relevant notice and a suitable collection channel before collection.

3. Why we use information

We use information as reasonably necessary for the following purposes:

- Responding to inquiries; reviewing applications and waitlist entries; confirming eligibility; scheduling

conversations; and communicating admission decisions.

- Creating and administering registrations, processing payments, managing balances, delivering promised

materials and access, providing support, and keeping transaction and consent records.

- Planning and delivering the Retreat, preparing relevant discussions, arranging included hospitality,

handling accommodation requests, and addressing safety or emergencies.

- Sending administrative messages about an application, purchase, itinerary, changes, or legal

obligations; and sending newsletters or marketing in accordance with applicable law and your

preferences.

- Understanding website and communication performance, improving content and user experience,

preventing misuse, securing systems, and troubleshooting errors.

- Measuring campaigns, creating permitted audiences, and displaying or measuring advertising, subject to

the choices and restrictions in Section 5.- Creating approved event documentation, educational materials, and promotional media under the

permissions in Section 7.

- Using authorized service providers and AI support tools as described in Section 8; maintaining business,

legal, tax, and accounting records; handling disputes; and complying with applicable law.

Information required to perform an Order or address a safety need may be necessary to provide that

service. Optional marketing, publicity, or unrelated data sharing is not made necessary merely by this

Policy. If we intend to use information for a materially different purpose requiring new notice or consent,

we will provide it first.

4. Who receives information

EPIC personnel and contracted support. Authorized team members, including Vic Keller when involved,

may access contact, application, event, and discussion information relevant to their duties. Access should

be limited to the work they perform for EPIC.

Operational providers. Website hosting, forms, customer relationship management, scheduling,

communications, cloud storage, security, analytics, transcription, and community providers may process

the relevant categories on our behalf. EPIC's platform arrangements may include Webflow for the Cabo

website; GoHighLevel for forms, calendars, communications, and customer management; Stripe for

payments; and Circle if related community access is provided. A listed provider is not necessarily used for

every interaction. Providers receive information needed for their role and are subject to appropriate

contractual restrictions where required.

Payment and financial services. Payment processors, banks, and fraud-prevention providers receive

payment and transaction information to process, verify, and administer payments and disputes. Some act

independently for legal, security, or regulatory purposes. Their own privacy notices explain those activities.

Event and hospitality providers. Venues, caterers, transport or excursion operators, photographers,

accessibility support, and other logistics providers may receive names, attendance details, relevant

preferences, or approved media needed for the service. Where an allergy or accommodation request must

be conveyed, we limit it to necessary information and obtain required permission. Independent hotels or

excursion services you book directly handle their own records.

Advertising and measurement partners. Subject to your choices and law, providers such as Google and

Meta may receive online identifiers, device and browsing activity, campaign interactions, and permitted

audience information for advertising or measurement. We do not authorize sharing health or accessibility

information, private business discussions, or SMS opt-in consent data for independent third-party

marketing. Section 5 explains how some advertising disclosures can legally count as a sale or sharing.

Other attendees and the public. Other attendees receive information you intentionally share in a session

or group. We do not automatically give all attendees your application, financial responses, or private

contact details. A directory or introduction involving nonpublic contact details is provided with appropriate

notice and choice. Public recipients may see authorized promotional media or content you intentionally

make public. We cannot control independent copies or disclosures made by other people, but will address

reported issues within our responsibility.

Advisers, authorities, and successors. We may disclose relevant records to legal, accounting, insurance,

and professional advisers; to authorities or other parties when legally required or reasonably necessary to

protect rights and safety; and to prospective or actual successors during a merger, financing,reorganization, or business sale, subject to appropriate safeguards. A business transfer does not

authorize materially incompatible data uses without the notice or consent the law requires.

We remain responsible for duties that applicable law assigns to EPIC. A reference to a third party's policy

does not eliminate our obligations when selecting or directing a provider.

5. Cookies, advertising, sale or sharing, and choices

Essential technologies support security, form operation, consent preferences, and requested website

features. Optional analytics, embedded media, and advertising technologies help measure use and

campaigns or provide personalized advertising. Emails may use pixels or link tracking to measure delivery

and engagement. A provider may associate device activity with other information it holds.

We do not sell personal information for money. However, disclosures of identifiers, browsing activity,

campaign activity, or permitted audience information to advertising partners may be a "sale," "sharing," or

"targeted advertising" under privacy laws even when no money changes hands. We treat qualifying

disclosures accordingly and provide required opt-out rights. We do not sell sensitive personal information

or use it for cross-context behavioral advertising.

Use the website's Privacy Choices control to manage optional cookies and opt out of sale, sharing, or

targeted advertising. You may also email info@vickeller.com with your preference. You do not need to

create an account to opt out. We honor applicable recognized opt-out preference signals, including Global

Privacy Control, as required by law. For a recognized browser signal, the choice applies at least to that

browser or device and to a known associated account where required and technically identifiable.

Where consent is required before optional technologies operate, they will remain off until you consent.

You may withdraw that consent through Privacy Choices. If you use different devices or browsers, clear

cookies, or browse without signing in, you may need to repeat a choice unless a legally required signal or

known account preference already applies. An opt-out stops covered future disclosures; it does not

necessarily stop every advertisement or remove historical data already lawfully received by an

independent party. You may separately exercise available deletion rights.

Browser controls can block or delete cookies, but may impair some features and do not replace every

legally required opt-out method. We do not generally respond to the older, nonstandard "Do Not Track"

setting; this is distinct from our treatment of legally recognized preference signals. When required, the

website will identify relevant technology categories, providers, and duration in its cookie controls or notice.

We do not knowingly sell or share information of people under 18.

6. Email, texts, calls, and consent records

We use your contact details to respond to requests and send necessary registration, payment, scheduling,

safety, and service information. Marketing communications follow applicable law and the choices you

make at signup. We do not treat a phone number supplied for an application as unlimited permission for

marketing texts, automated calls, or prerecorded or AI-generated voice marketing.

For marketing emails, use the unsubscribe link or contact info@vickeller.com. For texts, reply STOP to opt

out or HELP for assistance. Message frequency varies and message and data rates may apply. You may

revoke consent through other reasonable means as required by law. We process opt-outs within

applicable deadlines and may send a permitted nonmarketing confirmation. Required legal and

operational communications may continue through a lawful alternative channel; a label of "transactional"

does not override a legally effective revocation.Consent to marketing is not a condition of purchase. We may retain the language, timestamp, source,

scope, and status of a consent or opt-out to demonstrate compliance and prevent unwanted messages.

Mobile opt-in information and SMS consent are not shared with third parties or affiliates for their own

marketing. They may be provided to restricted messaging vendors that deliver the program for EPIC or

when legally required. Let us know if your phone number changes or is reassigned.

7. Recordings, event photography, and confidentiality

We may photograph or record identified event areas or sessions for documentation, education, quality, or

authorized marketing. Before recording or transcription begins, we provide notice and obtain consent

where required. A website visit or policy acknowledgment does not constitute blanket permission to record

a call, process sensitive information, or publish a testimonial.

Public promotional use of your identifiable likeness, voice, name, or statements is governed by the

applicable separate media permission. Tell us before the Retreat if you do not want to appear in

promotional content. We will explain available arrangements and respect legal consent and withdrawal

rights. Withdrawal may affect future uses but may not require recall of previously distributed material

where law permits its continued availability.

We do not intentionally publish private-session business details, health information, religious disclosures,

or other sensitive information under a general media permission. An attendee's participation in a private

discussion does not make that discussion public. Access to private recordings is limited to authorized

recipients and stated purposes. Do not record or transcribe others without the required permissions. You

can report an unauthorized disclosure to our privacy contact.

8. AI, automation, and human review

We may use authorized AI and automation tools to assist with communications, scheduling, support,

summaries or transcriptions of properly recorded sessions, application organization, analytics, and internal

administration. Relevant information may be processed by a provider for that function. AI may generate

inaccurate inferences or summaries; request correction or human review when needed.

Application support does not replace a human admission decision. We do not use solely automated

decision-making to make decisions with legal or similarly significant effects without the required notice,

legal basis, and safeguards. We do not use private applications, confidential discussions, or sensitive

information to train a public or general-purpose AI model without separate authorization. Ordinary

authorization to summarize a session is not authorization for unrelated model training.

Where a tool requires a new category of collection, independent data use, or consent for recording or

sensitive data, we will address it before enabling that use. Provider contracts, settings, and access

controls must be appropriate to the information handled.

9. Retention and security

We retain information only for as long as reasonably needed for the disclosed purpose or a lawful

retention obligation. The period depends on the category and use. Application and waitlist information

supports review and permitted future contact; we periodically assess whether it remains useful. Purchase

and agreement records support delivery, accounting, tax, disputes, and legal obligations. Event health or

accommodation notes are retained only as needed for the arrangement, safety, or an applicable legal

claim. Approved media may remain available for the authorized period, subject to withdrawal and other

legal rights.We consider the nature and sensitivity of information, our relationship with you, service and consent

requirements, relevant limitation periods, statutory recordkeeping duties, and whether a dispute or legal

hold exists. When no longer needed, we delete or deidentify information using appropriate methods.

Backup copies may persist until routine replacement, with use restricted as appropriate. We may keep a

minimal suppression record to honor an opt-out rather than re-add you to marketing.

We use reasonable administrative, technical, and organizational safeguards appropriate to the

information. No system or transmission method is completely secure. We address security incidents and

provide legally required notices. Please secure your devices and accounts and avoid sending

unnecessary sensitive information through general-purpose forms, group chats, or ordinary email.

10. Your requests and privacy rights

Depending on the applicable law, your location, the context, and whether EPIC is subject to that law, you

may have rights to confirm processing; access and obtain a copy of information; correct inaccuracies;

delete information; receive portable data; restrict or object to processing; withdraw consent; or opt out of

sale, sharing, targeted advertising, or certain profiling. You may also have a right to limit particular uses of

sensitive information. Legal exemptions may apply, including to some business-contact data or records

needed for compliance or claims.

Submit a request through the website's Privacy Choices or privacy request form, email

info@vickeller.com, or write to the address in Section 1. Describe the right you wish to exercise and

provide contact details associated with your interaction. We will request proportionate verification for

access, correction, deletion, or other requests where appropriate. We do not require unnecessary

verification for an opt-out. An authorized agent may act for you subject to applicable proof-of-authority and

verification rules. We provide a secure method if additional evidence is needed.

We will respond within the deadline that applies to your request. For covered US state access, correction,

or deletion requests, this is generally 45 days, with a further 45 days where law allows and after timely

notice explaining the extension. Shorter deadlines apply to some opt-outs and acknowledgments. We will

explain any denial, legal exception, or permissible fee. We do not charge for ordinary requests unless

applicable law permits it and we inform you first.

If a covered US state request is denied, email info@vickeller.com with "Privacy Appeal" and enough

information to identify the request. You may appeal within a reasonable period after the decision. We will

respond within the applicable deadline, no later than 60 days for a Texas appeal, and explain the result. If

an appeal is denied, we will provide information about contacting the appropriate regulator, including the

Texas Attorney General where applicable. You may also complain directly to your relevant regulator

without first contacting us.

We will not unlawfully discriminate or retaliate against you for exercising privacy rights. Some requests

may limit a feature that genuinely needs the information, but optional marketing or publicity is not made a

condition of a paid Retreat. Deletion does not automatically cancel an Order, erase legally required

accounting records, or eliminate existing payment or confidentiality obligations.11. Additional US state and California information

For residents covered by applicable comprehensive state privacy laws, the categories in Section 2 include

identifiers, customer-record information, commercial information, internet activity, professional information,

audio and visual information, inferences, and sensitive information where voluntarily provided for an event

need. Sections 3 and 4 describe the purposes and recipient categories. Retention criteria are in Section 9.

Sale, sharing, and targeted advertising choices are in Section 5.

Where the California Consumer Privacy Act applies, you may request disclosure of the categories and

specific pieces of personal information collected about you, categories of sources, purposes, and

categories of recipients, including information sold, shared, or disclosed for business purposes during the

applicable period. You may request deletion or correction, opt out of sale or sharing, and exercise any

applicable sensitive-information limitation right. We do not use sensitive information to infer characteristics

or for purposes requiring a limitation right unless we first provide the required notice and controls. We do

not knowingly sell or share the information of minors.

Where a California notice at collection or historical categories disclosure is required, we provide it at or

before collection and with the applicable privacy disclosures. The privacy contact and request methods

above are available for questions about the relevant categories and period. California residents may also

request information about covered disclosures for third parties' own direct marketing under California's

Shine the Light law, where applicable, using the same contact details. A statement that a disclosure is not

a monetary sale does not remove California sale or sharing rights.

12. Mexico and cross-border retreat operations

EPIC is based in the United States, and information used to operate the Cabo Retreat may also be

handled in Mexico and countries where our providers operate. For example, a Cabo venue may need an

attendee list or an approved dietary note. International transfers can be subject to different privacy laws.

We apply required safeguards, notices, contracts, and consent requirements; use of the website alone is

not blanket consent to every international transfer.

Where Mexico's private-sector data-protection law applies, you may exercise rights of access,

rectification, cancellation, and opposition (ARCO), revoke consent, or seek to limit use or disclosure

through the privacy contact in Section 1. State your name, response contact, the data or processing

involved, the requested action, and any information needed to locate your records. If requesting

correction, describe the correction and available supporting evidence. We will explain a suitable process

for verifying your identity or representative's authority.

For a complete and valid request governed by that law, we communicate the determination within the

applicable period, generally 20 business days, and implement an approved request within the following 15

business days, subject to lawful extensions, suspensions, and exceptions. Cancellation may involve

blocking records before deletion where legal retention applies. You may seek review from the competent

Mexican data-protection authority where available.

Essential purposes include reviewing your request, delivering the purchased event, coordinating

necessary hospitality and accommodations, safety, payment administration, and legal compliance.

Optional marketing and promotional publicity are secondary purposes; you may decline them through the

methods above without losing access to essential services. We obtain the form of consent required for

financial or sensitive information and non-exempt transfers. Any additional locally required notice identifies

the applicable local responsible party and processing details before collection.13. EEA, United Kingdom, and other international rights

Where the EU or UK data-protection rules apply to our processing, we rely on the legal basis appropriate

to the specific use: steps you request before a contract and contract performance for registration and

delivery; legal obligation for required records and regulatory responses; legitimate interests for

proportionate security, support, business administration, and service improvement after considering your

rights; and consent for marketing, optional tracking, recordings, or sensitive-data uses where required.

Emergency processing may rely on vital interests where legally available. We identify an additional lawful

condition before processing special-category data where needed.

Where those laws apply, you may also request restriction, object to processing based on legitimate

interests, object to direct marketing at any time, and seek portability for qualifying information. Consent

can be withdrawn without affecting the lawfulness of earlier processing. We generally respond within one

month and may extend by up to two further months where legally permitted, with timely explanation. You

may complain to your local supervisory authority or the UK Information Commissioner's Office.

For restricted international transfers, we use an applicable lawful mechanism, such as recognized

contractual safeguards or another permitted basis, and any required supplementary measures. Contact us

for the relevant mechanism and how to obtain information about safeguards, subject to necessary

redactions. Where an EU or UK representative or additional local notice is legally required, we provide its

details with the applicable notice before covered processing. Other jurisdictions may provide additional

rights, which you may raise with our privacy contact.

14. Children and independent third-party services

The Cabo offering is intended for adults age 18 and older. We do not knowingly solicit information from

children or sell or share their information. If you believe a child supplied information, contact us so we can

investigate and delete it or take another legally required step. An adult's attendance does not authorize

submission of a child's details.

Links, embedded media, and direct bookings can connect you to independently operated services. Review

their privacy notices and choices. EPIC's Policy covers processing for which EPIC is responsible and does

not describe every independent provider's practices.

15. Changes to this Policy

We may revise this Policy to reflect actual services, practices, or legal requirements. We will update the

date and provide additional notice for material changes as required. A new policy does not retroactively

create consent, erase a valid opt-out, or authorize a materially incompatible use. We will obtain new

consent when required. Contact info@vickeller.com for questions or to request a copy of the Policy

applicable to your interaction.

‍