Privacy notice

Orchid House PolancoMexico City

A. IDENTITY OF THE RESPONSIBLE PARTY

Avifin, S.A. de C.V., and its affiliates and/or subsidiaries, for purposes of marketing the products and/or services that Orchid House Polanco manages and/or distributes (hereinafter referred to as Orchid House Polanco or the Hotel, indistinctly), located at Campos Elíseos Avenue, number 76, Miguel Hidalgo, Mexico City, Z.C. 11560 (one one five six zero) is a company committed to protecting your privacy.

Our responsible for Data Protection is the Marketing and Systems Area and is located at the same address, you can contact him at the following email: direccion@orchidhousehotels.com.

This Privacy Notice applies to the following websites belonging to the Hotel, as well as all of its extensions:

https://www.orchidhousehotels.com/mexico-city/

B. PERSONAL DATA

For the purposes outlined in this Privacy Notice, Orchid House Polanco may collect your personal data in several ways:

a.- When the information is provided directly by you;

b.- When you visit the Hotel's websites;

c.- When you use the services offered by the Hotel online by the data you authorize the Hotel to take from your social networks (Facebook, Twitter, LinkedIn, Google);

d.- When you connect to the Wi-Fi that Orchid House Polanco offers you; or,

e.- When we obtain information through other means other than those mentioned above and that are permitted by applicable laws.

The personal data obtained by the means indicated above are:

a.- Identification: name(s), surname(s), telephone number(s), marital status, email address, age, date of birth, gender, company name and RFC number, Articles of Incorporation with its last modification, power of attorney of the legal representative, among others. Preferences related to lodging service and/or travel needs.

b.- Physical location: home address, tax address; dates of reservation and/or stay, hotel, date and time of flight.

c.- Authentication: username and password, autographic signature, voice recording.

d.- Patrimonial: bank card number, expiration date and security code, income level and occupancy.

C. SENSITIVE PERSONAL DATA

Sensitive personal data are considered to be those personal data that affect the most intimate sphere of their owner, or whose improper use may give rise to discrimination or entail a serious risk for the owner. In particular, are considered sensitive those that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions, sexual preferences.

The Hotel does not collect sensitive personal data, in case you require a particular service or product for which you provide this data, the Hotel will use them only to provide such service and meet your specific needs.

In case of health emergency(s) the Hotel, in terms of the applicable regulations, will collect data related to your health condition with the sole purpose of achieving the health protection of you and other people who are in the hotel or in any property managed by Orchid House Hotels, information that will only be stored for the time necessary to fulfill that purpose.

D. PURPOSE AND TREATMENT OF PERSONAL INFORMATION

Purposes that give rise to the legal relationship and are necessary for the provision of the service:

a.- The personal information you provide will be used by the Hotel to provide the services and/or products that you request or that are part of a program you have enrolled in or a purchase you have made: reservations, purchase of vacation packages, vacation club membership, affiliation to our loyalty programs, affiliation to our referral programs, organization of events and social gatherings, purchase of tourism products and/or services; providing where appropriate your data to the respective supplier.

b.- The Hotel may use the personal information you provide to offer you a better service and, where appropriate, identify your preferences during your stay and make it more pleasant.

Purposes that do not give rise to the legal relationship and are not necessary for the provision of the service and that you consent to be carried out:

a.- Likewise, it may use the information to offer you promotions and tourist and commercial products, send you promotions, special services, newsletters, surveys, prize draws and other online contests, transferring your personal data to the affiliated companies.

b.- Data analysis may be carried out through the use of technologies with the objective of elaborating profiles related to your stays and travel preferences that allow us to evaluate our service and personalize communication and promotions designed for you.

E. LIMITATION TO THE USE OR DISCLOSURE OF PERSONAL INFORMATION FOR PURPOSES THAT DO NOT GIVE RISE TO THE LEGAL RELATIONSHIP.

In order for you to limit the use and disclosure of your Personal Information for purposes that do not give rise to the legal relationship, we offer you the following means:

a.- If you are a resident of the United Mexican States, your registration in the Public Registry to Avoid Advertising, which is in charge of the Federal Consumer Attorney's Office, with the purpose that your personal information will not be used to receive advertising or promotions from companies of goods or services. For more information, you can consult the PROFECO's website, or contact it directly.

b.- Request to the e-mail direccion@orchidhousehotels.com, indicating the e-mail(s) and/or telephone number(s) that require your limitation.

F. EXERCISE OF THE RIGHTS OF ACCESS, RECTIFICATION, CANCELLATION AND OPPOSITION.

The access, rectification, cancellation or opposition regarding the information provided to the Hotel indicated in the Federal Law of Protection of Personal Data in Possession of Individuals, or in any applicable regulation, may be made by delivering the request in writing to the Marketing and Systems Area at the following address: Campos Elíseos Avenue, number 76, Miguel Hidalgo, Mexico City, Z.C. 11560 (one one five six zero), from 9 to 14 hours from Monday to Friday or to the e-mail direccion@orchidhousehotels.com.

Such request must contain at least the following:

Name of the Personal Data Subject;

E-mail address to receive notifications;

Documents proving identity or, as the case may be, legal representation of the owner;

Clear and precise description of the personal data with respect to which the right is sought to be exercised and the right that is intended to be exercised;

Any other element or document that facilitates the location of the personal data.

In the event that the request does not meet any of the aforementioned requirements, the Marketing and Systems Area may require you within 5 days of receipt of the request to provide the elements or documents necessary to process it. You will have 10 days to comply with the requirement, in case of not responding within such term, the corresponding request will be considered as not submitted. The terms of attention, unless the applicable regulations indicate otherwise, will be of a maximum of 20 days from the date on which the request is received to inform you of the determination adopted, so that, if it is appropriate, you may make the same effective within 15 days following the issuance of the response. The aforementioned deadlines may be extended once for an equal period, provided that the circumstances of the case so justify. In order to protect your confidentiality, the Hotel will send the response to your request to the e-mail address you have provided for that purpose and will keep it available to the applicant at the address indicated in the preceding paragraph.

G. REVOCATION OF CONSENT FOR THE USE OF YOUR PERSONAL DATA.

You may revoke the consent you have given us for the processing of your personal data. It is important to note that not in all cases the Hotel will be able to respond to your request or conclude immediately, since it is possible that some legal obligation may require us to continue processing your personal data. Also, you should consider that, for certain purposes, the revocation of your consent will mean that we can no longer provide the service you requested, or the conclusion of your relationship with the Hotel. To revoke your consent, you must submit your request in writing to the Marketing and Systems Area at the following address: Campos Elíseos Avenue, number 76, Miguel Hidalgo, Mexico City, Z.C. 11560 (one one five six zero), from 9 to 14 hours from Monday to Friday or by e-mail to direccion@orchidhousehotels.com. The processing of such request and the attention thereof shall be carried out in accordance with the provisions set forth in Section F, above.

H. CONTROL AND SECURITY OF PERSONAL INFORMATION.

The Hotel is committed to take the necessary measures to protect the information collected, using security technologies and procedures to control access, use or disclosure of your personal information without authorization, for example, storing the personal information provided in servers located in Data Centers that have limited access controls. For online transactions, we also use security technologies that protect personal information transmitted to us through various electronic means, such as the use of a secure server under the Secure Socket Layer (SSL) protocol. However, no security system or data transmission system over which the company does not have full control and/or reliance on the Internet can be guaranteed to be totally secure.

I. ELECTRONIC MEDIA AND COOKIES.

In the event that you use electronic means in relation to your personal data, cookies will be generated in order to provide you with a better service. Cookies are small pieces of information that are sent by the Web site to your browser. Cookies are stored on your computer's hard drive and are used to determine your preferences when you connect to the services of our sites, as well as to track certain behaviors or activities carried out by you within our sites.

In some sections of our site, we require the customer to have cookies enabled as some of the functionality requires cookies to work.

Cookies allow us to:

a.- Recognize you when you enter our sites and offer you a personalized experience;

b.- To know the personal configuration of the site specified by you, for example, cookies allow us to detect the bandwidth you have selected when entering the home page of our sites, so that we know what kind of information is advisable to download;

c.- Calculate the size of our audience and measure some traffic parameters, since each browser that accesses our sites acquires a cookie that is used to determine the frequency of use and the sections of the sites visited, thus reflecting your habits and preferences, information that is useful for us to improve the content, headlines and promotions for users. Cookies also help us to track some activities, for example, in some of the surveys we launch online, we may use cookies to detect if the user has already filled out the survey and avoid displaying it again, in case he/she has done so.

The "help" button on the toolbar of most browsers will tell you how to avoid accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable all cookies. However, cookies will allow you to take advantage of the most beneficial features we offer, so we recommend that you leave them turned on.

J. TRANSFERS

The Hotel only transfers personal data in the following cases:

a.- In the case of Mexico, in the assumptions established in article 37 of the Federal Law for the Protection of Personal Data in Possession of Private Parties;

b.- In the cases in which another international norm applies, it will only be transferred in the cases indicated therein;

c.- In the cases in which it is necessary to provide them to third party suppliers with respect to the services or products that are being contracted; and,

d.- In the cases in which you authorize the transmission of your data by physical or electronic means such as "Google Signals".

K. TERM OF CONSERVATION OF PERSONAL DATA.

Your personal data will be retained for as long as the legal relationship with you is maintained, until it is satisfactorily concluded, and you do not exercise your right of deletion or until you revoke your consent. In any case, the period of retention of personal data will be restricted to the minimum necessary, so that they will only be retained for as long as the purpose for which they were collected is maintained. When their conservation is no longer necessary, the Hotel will keep blocked those data that may be necessary during the legally established periods to address any issues related to their treatment or to the legal relationship originated with you. After the legal deadlines, the personal data will be deleted by adopting appropriate security measures to ensure the total destruction of the same.

L. CHANGES TO THIS PRIVACY NOTICE.

The Hotel may at any time update this privacy notice. In the event of substantial changes to this notice, we will communicate them through our web pages indicated in section A of this Privacy Notice. Therefore, we suggest that you periodically visit this privacy notice to be aware of any updates.

M. VIDEO SURVEILLANCE.

When you, as a Client, Supplier, Employee or Visitor, come to our facilities, you may be video recorded by the Hotel's security cameras, located at Campos Elíseos Avenue, number 76, Miguel Hidalgo, Mexico City, C.P. 11560 (one one five six zero). The images and sounds captured by the cameras will be used for the security of both the company and the people who visit us.

In case of any disagreement or complaint about the treatment of your personal data, you can address to the National Institute of Transparency, Access to Information and Protection of Personal Data in Mexico, or to the competent authority in the case that a standard other than the Mexican one applies.

Authoritative version.

The authoritative version of the present privacy notice, for all legal effects, will be the one written in Spanish.

Any controversy regarding to the terms here employed, their meaning, the legal context or interpretation of the present notice shall be done taking into account the authoritative version of the text.

The English version exists only as means for comfort of English speakers, but by their acceptance of the present document, they are accepting to the authoritative version of it.

I acknowledge and accept the terms and conditions set forth in this Privacy Notice, and otherwise I will notify Avifin, S.A. de C.V. in terms of the provisions of paragraphs E, F and G. of this Privacy Notice.

‍

Orchid House BajaLa Paz, BCS

Orchid Design, S.A. de C.V., and its affiliates and/or subsidiaries, for purposes of marketing the products and/or services that Orchid House Baja manages and/or distributes (hereinafter referred to as Orchid House Baja or the Hotel, indistinctly), located at kilometer five of the Carretera Escénica, section Pichilingue - La Paz, Municipality of La Paz, Baja California Sur, C.P. 23019 (two three zero one nine) is a company committed to protecting your privacy.

Our responsible for Data Protection is the Marketing and Systems Area and is located at the same address, you can contact him at the following email: direccion@orchidhousehotels.com.

This Privacy Notice applies to the following website belonging to the Hotel, as well as to all its extensions:

https://www.orchidhousehotels.com/la-paz-baja-california/

For the purposes outlined in this Privacy Notice, Orchid House Baja may collect your personal data in several ways:

a.- When the information is provided directly by you;

b.- When you visit the Hotel's websites;

c.- When you use the services offered by the Hotel online by the data you authorize the Hotel to take from your social networks (Facebook, Twitter, LinkedIn, Google);

d.- When you connect to the Wi-Fi that Orchid House Baja offers you; or,

e.- When we obtain information through other means other than those mentioned above and that are permitted by applicable laws.

The personal data obtained by the means indicated above are:

a.- Identification: name(s), surname(s), telephone number(s), marital status, email address, age, date of birth, gender, company name and RFC number, Articles of Incorporation with its last modification, power of attorney of the legal representative, among others. Preferences related to lodging service and/or travel needs.

b.- Physical location: home address, tax address; dates of reservation and/or stay, hotel, date and time of flight.

c.- Authentication: username and password, autographic signature, voice recording.

d.- Patrimonial: bank card number, expiration date and security code, income level and occupancy.

Sensitive personal data are considered to be those personal data that affect the most intimate sphere of their owner, or whose improper use may give rise to discrimination or entail a serious risk for the owner. In particular, are considered sensitive those that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions, sexual preferences.

The Hotel does not collect sensitive personal data, in case you require a particular service or product for which you provide this data, the Hotel will use them only to provide such service and meet your specific needs.

In case of health emergency(s) the Hotel, in terms of the applicable regulations, will collect data related to your health condition with the sole purpose of achieving the health protection of you and other people who are in the hotel or in any property managed by Orchid House Hotels, information that will only be stored for the time necessary to fulfill that purpose.

Purposes that give rise to the legal relationship and are necessary for the provision of the service:

a.- The personal information you provide will be used by the Hotel to provide the services and/or products that you request or that are part of a program you have enrolled in or a purchase you have made: reservations, purchase of vacation packages, vacation club membership, affiliation to our loyalty programs, affiliation to our referral programs, organization of events and social gatherings, purchase of tourism products and/or services; providing where appropriate your data to the respective supplier.

b.- The Hotel may use the personal information you provide to offer you a better service and, where appropriate, identify your preferences during your stay and make it more pleasant.

Purposes that do not give rise to the legal relationship and are not necessary for the provision of the service and that you consent to be carried out:

a.- Likewise, it may use the information to offer you promotions and tourist and commercial products, send you promotions, special services, newsletters, surveys, prize draws and other online contests, transferring your personal data to the affiliated companies.

b.- Data analysis may be carried out through the use of technologies with the objective of elaborating profiles related to your stays and travel preferences that allow us to evaluate our service and personalize communication and promotions designed for you.

In order for you to limit the use and disclosure of your Personal Information for purposes that do not give rise to the legal relationship, we offer you the following means:

a.- If you are a resident of the United Mexican States, your registration in the Public Registry to Avoid Advertising, which is in charge of the Federal Consumer Attorney's Office, with the purpose that your personal information will not be used to receive advertising or promotions from companies of goods or services. For more information, you can consult the PROFECO's website, or contact it directly.

b.- Request to the e-mail direccion@orchidhousehotels.com, indicating the e-mail(s) and/or telephone number(s) that require your limitation.

The access, rectification, cancellation or opposition regarding the information provided to the Hotel indicated in the Federal Law of Protection of Personal Data in Possession of Individuals, or in any applicable regulation, may be made by delivering the request in writing to the Marketing and Systems Area at the following address: kilometer five of the Carretera Escénica, section Pichilingue - La Paz, Municipality of La Paz, Baja California Sur, C.P. 23019 (two three zero one nine), from 9 to 14 hours from Monday to Friday or to the e-mail direccion@orchidhousehotels.com.

Such request must contain at least the following:

Name of the Personal Data Subject;

E-mail address to receive notifications;

Documents proving identity or, as the case may be, legal representation of the owner;

Clear and precise description of the personal data with respect to which the right is sought to be exercised and the right that is intended to be exercised;

Any other element or document that facilitates the location of the personal data.

In the event that the request does not meet any of the aforementioned requirements, the Marketing and Systems Area may require you within 5 days of receipt of the request to provide the elements or documents necessary to process it. You will have 10 days to comply with the requirement, in case of not responding within such term, the corresponding request will be considered as not submitted. The terms of attention, unless the applicable regulations indicate otherwise, will be of a maximum of 20 days from the date on which the request is received to inform you of the determination adopted, so that, if it is appropriate, you may make the same effective within 15 days following the issuance of the response. The aforementioned deadlines may be extended once for an equal period, provided that the circumstances of the case so justify. In order to protect your confidentiality, the Hotel will send the response to your request to the e-mail address you have provided for that purpose and will keep it available to the applicant at the address indicated in the preceding paragraph.

You may revoke the consent you have given us for the processing of your personal data. It is important to note that not in all cases the Hotel will be able to respond to your request or conclude immediately, since it is possible that some legal obligation may require us to continue processing your personal data. Also, you should consider that, for certain purposes, the revocation of your consent will mean that we can no longer provide the service you requested, or the conclusion of your relationship with the Hotel. To revoke your consent, you must submit your request in writing to the Marketing and Systems Area at the following address: kilometer five of the Carretera Escénica, section Pichilingue - La Paz, Municipality of La Paz, Baja California Sur, C.P. 23019 (two three zero one nine), from 9 to 14 hours from Monday to Friday or by e-mail to direccion@orchidhousehotels.com. The processing of such request and the attention thereof shall be carried out in accordance with the provisions set forth in Section F, above.

The Hotel is committed to take the necessary measures to protect the information collected, using security technologies and procedures to control access, use or disclosure of your personal information without authorization, for example, storing the personal information provided in servers located in Data Centers that have limited access controls. For online transactions, we also use security technologies that protect personal information transmitted to us through various electronic means, such as the use of a secure server under the Secure Socket Layer (SSL) protocol. However, no security system or data transmission system over which the company does not have full control and/or reliance on the Internet can be guaranteed to be totally secure.

In the event that you use electronic means in relation to your personal data, cookies will be generated in order to provide you with a better service. Cookies are small pieces of information that are sent by the Web site to your browser. Cookies are stored on your computer's hard drive and are used to determine your preferences when you connect to the services of our sites, as well as to track certain behaviors or activities carried out by you within our sites.

In some sections of our site, we require the customer to have cookies enabled as some of the functionality requires cookies to work.

Cookies allow us to:

a.- Recognize you when you enter our sites and offer you a personalized experience;

b.- To know the personal configuration of the site specified by you, for example, cookies allow us to detect the bandwidth you have selected when entering the home page of our sites, so that we know what kind of information is advisable to download;

c.- Calculate the size of our audience and measure some traffic parameters, since each browser that accesses our sites acquires a cookie that is used to determine the frequency of use and the sections of the sites visited, thus reflecting your habits and preferences, information that is useful for us to improve the content, headlines and promotions for users. Cookies also help us to track some activities, for example, in some of the surveys we launch online, we may use cookies to detect if the user has already filled out the survey and avoid displaying it again, in case he/she has done so.

The "help" button on the toolbar of most browsers will tell you how to avoid accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable all cookies. However, cookies will allow you to take advantage of the most beneficial features we offer, so we recommend that you leave them turned on.

The Hotel only transfers personal data in the following cases:

a.- In the case of Mexico, in the assumptions established in article 37 of the Federal Law for the Protection of Personal Data in Possession of Private Parties;

b.- In the cases in which another international norm applies, it will only be transferred in the cases indicated therein;

c.- In the cases in which it is necessary to provide them to third party suppliers with respect to the services or products that are being contracted; and,

d.- In the cases in which you authorize the transmission of your data by physical or electronic means such as "Google Signals".

Your personal data will be retained for as long as the legal relationship with you is maintained, until it is satisfactorily concluded, and you do not exercise your right of deletion or until you revoke your consent. In any case, the period of retention of personal data will be restricted to the minimum necessary, so that they will only be retained for as long as the purpose for which they were collected is maintained. When their conservation is no longer necessary, the Hotel will keep blocked those data that may be necessary during the legally established periods to address any issues related to their treatment or to the legal relationship originated with you. After the legal deadlines, the personal data will be deleted by adopting appropriate security measures to ensure the total destruction of the same.

The Hotel may at any time update this privacy notice. In the event of substantial changes to this notice, we will communicate them through our web pages indicated in section A of this Privacy Notice. Therefore, we suggest that you periodically visit this privacy notice to be aware of any updates.

When you, as a Client, Supplier, Employee or Visitor, come to our facilities, you may be video recorded by the Hotel's security cameras, located at kilometer five of the Carretera Escénica, Pichilingue - La Paz section, Municipality of La Paz, Baja California Sur, C.P. 23019 (two three zero one nine). The images and sounds captured by the cameras will be used for the security of both the company and the people who visit us.

In case of any disagreement or complaint about the treatment of your personal data, you can address to the National Institute of Transparency, Access to Information and Protection of Personal Data in Mexico, or to the competent authority in the case that a standard other than the Mexican one applies.

Authoritative version.

The authoritative version of the present privacy notice, for all legal effects, will be the one written in Spanish.

Any controversy regarding to the terms here employed, their meaning, the legal context or interpretation of the present notice shall be done taking into account the authoritative version of the text.

The English version exists only as means for comfort of English speakers, but by their acceptance of the present document, they are accepting to the authoritative version of it.

I acknowledge and accept the terms and conditions set forth in this Privacy Notice, and otherwise I will notify Orchid Design, S.A. de C.V. in terms of the provisions of paragraphs E, F and G. of this Privacy Notice.

‍

Orchid House San MiguelSan Miguel de Allende

OH San Miguel, S.A. de C.V., and its affiliates and/or subsidiaries, for purposes of marketing the products and/or services that Orchid House San Miguel manages and/or distributes (hereinafter referred to as Orchid House San Miguel or the Hotel, indistinctly), located at Hidalgo street, number 21, Downtown, San Miguel de Allende, Guanajuato, Z.C. 37700 (three seven seven zero zero) is a company committed to protecting your privacy.

Our responsible for Data Protection is the Marketing and Systems Area and is located at the same address, you can contact him at the following email: direccion@orchidhousehotels.com.

This Privacy Notice applies to the following websites belonging to the Hotel, as well as all of its extensions:

https://www.orchidhousehotels.com/san-miguel-de-allende/

For the purposes outlined in this Privacy Notice, Orchid House San Miguel may collect your personal data in several ways:

a.- When the information is provided directly by you;

b.- When you visit the Hotel's websites;

c.- When you use the services offered by the Hotel online by the data you authorize the Hotel to take from your social networks (Facebook, Twitter, LinkedIn, Google);

d.- When you connect to the Wi-Fi that Orchid House San Miguel offers you; or,

e.- When we obtain information through other means other than those mentioned above and that are permitted by applicable laws.

The personal data obtained by the means indicated above are:

a.- Identification: name(s), surname(s), telephone number(s), marital status, email address, age, date of birth, gender, company name and RFC number, Articles of Incorporation with its last modification, power of attorney of the legal representative, among others. Preferences related to lodging service and/or travel needs.

b.- Physical location: home address, tax address; dates of reservation and/or stay, hotel, date and time of flight.

c.- Authentication: username and password, autographic signature, voice recording.

d.- Patrimonial: bank card number, expiration date and security code, income level and occupancy.

Sensitive personal data are considered to be those personal data that affect the most intimate sphere of their owner, or whose improper use may give rise to discrimination or entail a serious risk for the owner. In particular, are considered sensitive those that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions, sexual preferences.

The Hotel does not collect sensitive personal data, in case you require a particular service or product for which you provide this data, the Hotel will use them only to provide such service and meet your specific needs.

In case of health emergency(s) the Hotel, in terms of the applicable regulations, will collect data related to your health condition with the sole purpose of achieving the health protection of you and other people who are in the hotel or in any property managed by Orchid House Hotels, information that will only be stored for the time necessary to fulfill that purpose.

Purposes that give rise to the legal relationship and are necessary for the provision of the service:

a.- The personal information you provide will be used by the Hotel to provide the services and/or products that you request or that are part of a program you have enrolled in or a purchase you have made: reservations, purchase of vacation packages, vacation club membership, affiliation to our loyalty programs, affiliation to our referral programs, organization of events and social gatherings, purchase of tourism products and/or services; providing where appropriate your data to the respective supplier.

b.- The Hotel may use the personal information you provide to offer you a better service and, where appropriate, identify your preferences during your stay and make it more pleasant.

Purposes that do not give rise to the legal relationship and are not necessary for the provision of the service and that you consent to be carried out:

a.- Likewise, it may use the information to offer you promotions and tourist and commercial products, send you promotions, special services, newsletters, surveys, prize draws and other online contests, transferring your personal data to the affiliated companies.

b.- Data analysis may be carried out through the use of technologies with the objective of elaborating profiles related to your stays and travel preferences that allow us to evaluate our service and personalize communication and promotions designed for you.

In order for you to limit the use and disclosure of your Personal Information for purposes that do not give rise to the legal relationship, we offer you the following means:

a.- If you are a resident of the United Mexican States, your registration in the Public Registry to Avoid Advertising, which is in charge of the Federal Consumer Attorney's Office, with the purpose that your personal information will not be used to receive advertising or promotions from companies of goods or services. For more information, you can consult the PROFECO's website, or contact it directly.

b.- Request to the e-mail direccion@orchidhousehotels.com, indicating the e-mail(s) and/or telephone number(s) that require your limitation.

The access, rectification, cancellation or opposition regarding the information provided to the Hotel indicated in the Federal Law of Protection of Personal Data in Possession of Individuals, or in any applicable regulation, may be made by delivering the request in writing to the Marketing and Systems Area at the following address: Hidalgo street, number 21, Downtown, San Miguel de Allende, Guanajuato, Z.C. 37700 (three seven seven zero zero), from 9 to 14 hours from Monday to Friday or to the e-mail direccion@orchidhousehotels.com.

Such request must contain at least the following:

Name of the Personal Data Subject;

E-mail address to receive notifications;

Documents proving identity or, as the case may be, legal representation of the owner;

Clear and precise description of the personal data with respect to which the right is sought to be exercised and the right that is intended to be exercised;

Any other element or document that facilitates the location of the personal data.

In the event that the request does not meet any of the aforementioned requirements, the Marketing and Systems Area may require you within 5 days of receipt of the request to provide the elements or documents necessary to process it. You will have 10 days to comply with the requirement, in case of not responding within such term, the corresponding request will be considered as not submitted. The terms of attention, unless the applicable regulations indicate otherwise, will be of a maximum of 20 days from the date on which the request is received to inform you of the determination adopted, so that, if it is appropriate, you may make the same effective within 15 days following the issuance of the response. The aforementioned deadlines may be extended once for an equal period, provided that the circumstances of the case so justify. In order to protect your confidentiality, the Hotel will send the response to your request to the e-mail address you have provided for that purpose and will keep it available to the applicant at the address indicated in the preceding paragraph.

You may revoke the consent you have given us for the processing of your personal data. It is important to note that not in all cases the Hotel will be able to respond to your request or conclude immediately, since it is possible that some legal obligation may require us to continue processing your personal data. Also, you should consider that, for certain purposes, the revocation of your consent will mean that we can no longer provide the service you requested, or the conclusion of your relationship with the Hotel. To revoke your consent, you must submit your request in writing to the Marketing and Systems Area at the following address: Hidalgo street, number 21, Downtown, San Miguel de Allende, Guanajuato, Z.C. 37700 (three seven seven zero zero), from 9 to 14 hours from Monday to Friday or by e-mail to direccion@orchidhousehotels.com. The processing of such request and the attention thereof shall be carried out in accordance with the provisions set forth in Section F, above.

The Hotel is committed to take the necessary measures to protect the information collected, using security technologies and procedures to control access, use or disclosure of your personal information without authorization, for example, storing the personal information provided in servers located in Data Centers that have limited access controls. For online transactions, we also use security technologies that protect personal information transmitted to us through various electronic means, such as the use of a secure server under the Secure Socket Layer (SSL) protocol. However, no security system or data transmission system over which the company does not have full control and/or reliance on the Internet can be guaranteed to be totally secure.

In the event that you use electronic means in relation to your personal data, cookies will be generated in order to provide you with a better service. Cookies are small pieces of information that are sent by the Web site to your browser. Cookies are stored on your computer's hard drive and are used to determine your preferences when you connect to the services of our sites, as well as to track certain behaviors or activities carried out by you within our sites.

In some sections of our site, we require the customer to have cookies enabled as some of the functionality requires cookies to work.

Cookies allow us to:

a.- Recognize you when you enter our sites and offer you a personalized experience;

b.- To know the personal configuration of the site specified by you, for example, cookies allow us to detect the bandwidth you have selected when entering the home page of our sites, so that we know what kind of information is advisable to download;

c.- Calculate the size of our audience and measure some traffic parameters, since each browser that accesses our sites acquires a cookie that is used to determine the frequency of use and the sections of the sites visited, thus reflecting your habits and preferences, information that is useful for us to improve the content, headlines and promotions for users. Cookies also help us to track some activities, for example, in some of the surveys we launch online, we may use cookies to detect if the user has already filled out the survey and avoid displaying it again, in case he/she has done so.

The "help" button on the toolbar of most browsers will tell you how to avoid accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable all cookies. However, cookies will allow you to take advantage of the most beneficial features we offer, so we recommend that you leave them turned on.

The Hotel only transfers personal data in the following cases:

a.- In the case of Mexico, in the assumptions established in article 37 of the Federal Law for the Protection of Personal Data in Possession of Private Parties;

b.- In the cases in which another international norm applies, it will only be transferred in the cases indicated therein;

c.- In the cases in which it is necessary to provide them to third party suppliers with respect to the services or products that are being contracted; and,

d.- In the cases in which you authorize the transmission of your data by physical or electronic means such as "Google Signals".

Your personal data will be retained for as long as the legal relationship with you is maintained, until it is satisfactorily concluded, and you do not exercise your right of deletion or until you revoke your consent. In any case, the period of retention of personal data will be restricted to the minimum necessary, so that they will only be retained for as long as the purpose for which they were collected is maintained. When their conservation is no longer necessary, the Hotel will keep blocked those data that may be necessary during the legally established periods to address any issues related to their treatment or to the legal relationship originated with you. After the legal deadlines, the personal data will be deleted by adopting appropriate security measures to ensure the total destruction of the same.

The Hotel may at any time update this privacy notice. In the event of substantial changes to this notice, we will communicate them through our web pages indicated in section A of this Privacy Notice. Therefore, we suggest that you periodically visit this privacy notice to be aware of any updates.

When you, as a Client, Supplier, Employee or Visitor, come to our facilities, you may be video recorded by the Hotel's security cameras, located at Hidalgo street, number 21, Downtown, San Miguel de Allende, Guanajuato, C.P. 37700 (three seven seven zero zero). The images and sounds captured by the cameras will be used for the security of both the company and the people who visit us.

In case of any disagreement or complaint about the treatment of your personal data, you can address to the National Institute of Transparency, Access to Information and Protection of Personal Data in Mexico, or to the competent authority in the case that a standard other than the Mexican one applies.

Authoritative version.

The authoritative version of the present privacy notice, for all legal effects, will be the one written in Spanish.

Any controversy regarding to the terms here employed, their meaning, the legal context or interpretation of the present notice shall be done taking into account the authoritative version of the text.

The English version exists only as means for comfort of English speakers, but by their acceptance of the present document, they are accepting to the authoritative version of it.

I acknowledge and accept the terms and conditions set forth in this Privacy Notice, and otherwise I will notify OH San Miguel, S.A. de C.V. in terms of the provisions of paragraphs E, F and G. of this Privacy Notice.

‍

‍

‍

‍

Máximo México RomaRoma Sur, Mexico City

Last updated: September 2, 2026.

A. IDENTITY AND ADDRESS OF THE DATA CONTROLLER

Autounión Suecia, S.A. de C.V., with Federal Taxpayer Registry number ASU2410111U3, the company operating the lodging establishment commercially known as Máximo México Hotel (hereinafter, interchangeably, "Máximo" or "the Hotel"), with address at Calle Manzanillo número 47, Colonia Roma Sur, Alcaldía Cuauhtémoc, Postal Code 06760, Mexico City, is the controller responsible for the processing of your personal data and is committed to protecting your privacy.

The area responsible for personal data protection is the Marketing and Systems Department, located at the address noted above. You may contact this department through the following means:

• ·Email: roma@maximomexico.com
• ·Phone: +52 55 1078 5928
• ·In person, at the Hotel's address, Monday through Friday from 9:00 a.m. to 2:00 p.m.

This Privacy Notice applies to the website https://www.maximomexico.com, its reservation engines, the Hotel's guest-service channels, and the establishment's facilities.

Máximo México Hotel is an adults-only establishment. The Hotel does not provide services to minors and does not knowingly process their personal data.

B. PERSONAL DATA SUBJECT TO PROCESSING

B.1 Means of collection

The Hotel obtains your personal data through the following channels:

• ·Directly, when you provide it in person, in writing, or verbally.
• ·Through the Hotel's website and its online reservation engine.
• ·Through the telephone reservations center.
• ·Through online travel agencies (OTAs) and other distribution intermediaries, which transmit to the Hotel the data necessary to formalize your reservation.
• ·Through WhatsApp, email, and social-media messaging.
• ·Through event and group quotation forms.
• ·During in-person check-in at the Hotel.
• ·Through use of the Hotel's Wi-Fi network, cookies, and similar tracking technologies.
• ·Through the facilities' video-surveillance system.

B.2 Categories of data

• ·Identification and contact data: first and last name, nationality, type and number of official identification document or passport, phone number, email address, handwritten signature.
• ·Reservation and stay data: arrival and departure dates, room type, number of adult companions, purpose of travel, estimated arrival time, lodging preferences, history of previous stays at the Hotel.
• ·Tax data (only if you request a tax invoice): RFC (tax ID), legal/business name, tax address, tax regime, and CFDI use.
• ·Financial and payment data: card brand, the last four digits of your card, and the transaction result.

The Hotel does NOT store your card's full number, expiration date, or security code (CVV/CVC). This data is captured and processed directly within the payment service provider's encrypted environment, without the Hotel having access to it or retaining it.

• ·Image data: images captured by the video-surveillance system in the Hotel's common areas.
• ·Browsing data: IP address, device and browser type, operating system, pages visited, time spent on the site, and cookie-related identifiers.

The Hotel collects only the data necessary for the purposes described in this Notice and does not request information about your income level, marital status, or occupation.

C. SENSITIVE PERSONAL DATA

Sensitive personal data are those that affect the most intimate sphere of the data subject, or whose misuse could give rise to discrimination or entail a serious risk to that person. In particular, data that could reveal racial or ethnic origin, present or future health status, genetic information, religious, philosophical, or moral beliefs, union membership, political opinions, or sexual preference.

The Hotel does not require, nor does it condition the provision of its services on, the delivery of sensitive personal data. However, you may voluntarily provide the following information so that the Hotel can properly attend to your stay:

• ·Food allergies, intolerances, or dietary restrictions, for the preparation of food and beverages.
• ·Health or mobility conditions relevant to room assignment, to your safety during your stay, or to responding to an emergency.
• ·Accessibility requirements.

Where you provide this information, the Hotel will process it exclusively for the specific purpose stated, under access restricted to personnel who strictly need it, and will delete it once your stay has concluded, unless a legal retention obligation applies.

Processing this data requires your express consent, which is obtained through the corresponding checkbox on the reservation or registration form, or through your signature on the corresponding consent letter. You may decline to give it without this affecting the provision of the lodging service.

In the event of a health emergency declared by a competent authority, the Hotel may collect health-related data required by applicable rules, solely for the purpose of protecting your health and that of other persons present at the establishment, retaining it only for as long as that purpose requires.

D. PURPOSES OF PROCESSING

D.1 Necessary purposes

The following purposes give rise to, and are necessary for, the legal relationship between you and the Hotel:

• ·Managing, confirming, modifying, and cancelling your reservation.
• ·Carrying out check-in and check-out, and maintaining the guest register.
• ·Processing payment for the services contracted and issuing the corresponding tax invoice.
• ·Providing lodging, food and beverage, and other services requested during your stay.
• ·Handling your requests, comments, clarifications, and complaints.
• ·Organizing events, meetings, and groups that you book.
• ·Preserving the safety of persons and property within the facilities.
• ·Complying with legal obligations relating to tax, immigration, civil-protection, and consumer-protection matters, as well as responding to requirements from competent authorities.

D.2 Voluntary purposes

The following purposes are not necessary for the legal relationship and will only be carried out if you consent to them. Declining them does not in any way affect your reservation or the quality of service you receive:

• ·Sending newsletters, promotions, special rates, and commercial communications from the Hotel.
• ·Enrollment in and administration of the loyalty program and benefits for returning guests.
• ·Sending satisfaction and service-quality surveys.
• ·Targeted advertising and remarketing on digital platforms such as Google and Meta.
• ·Building travel- and lodging-preference profiles, through data analysis, in order to personalize the communications and offers directed to you.
• ·Distribution of photographs or audio-visual material captured during events held at the Hotel, on its institutional channels and social media.

D.3 How to withhold consent for voluntary purposes

You may state your refusal at any of the following times and through any of the following means:

• ·Checking the opt-out box on the reservation, registration, or subscription form, at the time your data is collected.
• ·Sending an email to roma@maximomexico.com within five business days of being informed of this Notice.
• ·At any later time, in accordance with Sections F and H of this Notice.

E. LIMITING THE USE AND DISCLOSURE OF YOUR DATA

To limit the use or disclosure of your personal data for marketing or advertising purposes, the Hotel makes the following means available to you:

• ·The unsubscribe link included at the bottom of every electronic communication you receive from the Hotel.
• ·A request sent to roma@maximomexico.com, specifying the email addresses or phone numbers for which you request the limitation.
• ·If you reside in the United Mexican States, registering with the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad, REPEP), administered by the Federal Consumer Protection Agency (PROFECO), available through that institution's website.

F. DISCLOSURES, TRANSFERS, AND INTERNATIONAL TRANSFERS

F.1 Disclosures to data processors

The Hotel relies on technology providers who process personal data on the Hotel's behalf and under its instructions, without using it for their own purposes. These disclosures constitute data-processor transmissions and do not require your consent. Current processors fall into the following categories:

• ·Hotel management system (PMS): Cloudbeds, for managing reservations, guest registration, and billing.
• ·Payment processing: Cloudbeds Payment.
• ·Email and marketing platform: Axovia Hospitality Marketing's proprietary platform.
• ·Analytics and digital advertising: Google (Analytics and Ads) and Meta (Facebook and Instagram), through cookies and advertising identifiers.
• ·Website hosting and cloud infrastructure.

The Hotel maintains contractual instruments with these providers that impose confidentiality and security obligations equivalent to those set out in this Notice.

F.2 Transfers that do not require your consent

Under applicable law, the Hotel may transfer your personal data, without requiring your consent, in the following cases:

• ·To the Tax Administration Service (SAT), to comply with tax obligations.
• ·To the National Immigration Institute (INM), regarding foreign-national guests, in accordance with the registration and reporting obligations set out in the Immigration Law and its Regulations.
• ·To competent administrative, judicial, or prosecutorial authorities, upon a duly substantiated and reasoned request.
• ·To the Hotel's external auditors and legal or accounting advisors, subject to confidentiality obligations.

Outside of the cases described above, the Hotel does not market, sell, assign, or transfer your personal data to third parties for their own purposes.

F.3 International transfers

Some of the technology providers referenced in Section F.1 are established outside Mexican territory, principally in the United States of America and the European Union, and your personal data may therefore be stored or processed on servers located in those jurisdictions. In such cases, the Hotel adopts contractual measures requiring those providers to maintain a level of protection equivalent to that required by Mexican law and by this Privacy Notice.

G. ARCO RIGHTS

You, or your duly accredited legal representative, have the right to access your personal data, to rectify it when it is inaccurate or incomplete, to have it cancelled when you consider it is no longer required for any of the stated purposes, and to object to its processing for specific purposes (Access, Rectification, Cancellation, and Objection rights — "ARCO rights" under Mexican law).

The corresponding request must be submitted in writing at the Hotel's address, Monday through Friday from 9:00 a.m. to 2:00 p.m., or sent by email to roma@maximomexico.com, and must include at least:

• ·The name of the personal-data subject.
• ·An email address or mailing address for receiving notifications.
• ·Documents evidencing your identity or, where applicable, the data subject's legal representation.
• ·A clear and precise description of the personal data over which you seek to exercise the right, and of the right you intend to exercise.
• ·Any other element or document that facilitates locating your personal data.

If the request does not meet any of the requirements above, the Hotel may, within five business days of receiving it, ask you to provide the missing elements or documents. You will then have ten business days to respond to that request; failing to do so, the request will be deemed not submitted.

The Hotel will communicate its determination within twenty business days of receiving the request and, if applicable, will give effect to it within fifteen business days following that response. These periods may be extended once, for an equal period, when the circumstances of the case justify it. The response will be sent to the email address you provided and will also be made available at the Hotel's address.

Exercising these rights is free of charge. You will only need to cover, where applicable, the justified costs of shipping or of reproduction in copies or other formats.

H. WITHDRAWAL OF CONSENT

You may withdraw, at any time, the consent you have given for the processing of your personal data, following the same procedure and through the same means indicated in Section G.

Please note that, in certain cases, the Hotel may not be able to fulfill your request immediately or in full, due to legal obligations that require it to continue processing certain data. Likewise, withdrawing consent for the necessary purposes may make it impossible for the Hotel to continue providing the contracted service.

I. VIDEO SURVEILLANCE

When you visit the Hotel's facilities, as a guest, visitor, supplier, or staff member, your image may be captured by the closed-circuit television system installed at the property located at Calle Manzanillo número 47, Colonia Roma Sur, Alcaldía Cuauhtémoc, Postal Code 06760, Mexico City.

The cameras are located at entrances, hallways, and common areas, and are duly marked with signage. There are no cameras inside guest rooms, restrooms, changing rooms, or any other area intended for personal privacy.

The system captures images only and does not capture or record audio. The images are used exclusively for the safety of persons and property, and for clarifying incidents. They are retained for a period of 30 calendar days, after which they are automatically deleted, unless a given recording must be retained because it relates to an incident under investigation or to a request from a competent authority.

J. COOKIES AND TRACKING TECHNOLOGIES

The Hotel's website uses cookies and similar technologies, which are small information files stored on your device. The Hotel uses the following categories:

• ·Strictly necessary: enable the website and reservation engine to function. These cannot be disabled.
• ·Preference: remember the language, currency, and settings you have selected.
• ·Analytics: allow the Hotel to measure traffic and understand how the site is used, through tools such as Google Analytics.
• ·Advertising: allow the Hotel to show you advertising on third-party platforms and measure its effectiveness, through tools such as Google Ads and the Meta pixel.

When you enter the site, you are shown a settings panel that lets you accept or reject the non-necessary categories. You may change your choice at any time from that panel, as well as configure your browser to block or delete cookies. Disabling non-necessary cookies does not prevent you from using the site or making reservations.

K. RETENTION PERIODS

Your personal data will be retained for the time strictly necessary to fulfill the purposes for which it was obtained, according to the following criteria:

• ·Reservation and stay data: for the duration of the legal relationship and, thereafter, for the period necessary to address clarifications, claims, or liabilities arising from it.
• ·Tax data and invoices: for the period established by applicable tax law for the retention of accounting records.
• ·Foreign-guest registration records: for the period set out in immigration regulations.
• ·Data processed for marketing purposes: until you withdraw your consent or request removal.
• ·Video-surveillance recordings: in accordance with the period stated in Section I.
• ·Sensitive data provided voluntarily: until the end of your stay.

Once the applicable periods have elapsed, the data will be blocked for the period during which it may be necessary to address legal liabilities and will thereafter be deleted through measures that ensure its secure destruction.

L. SECURITY MEASURES

The Hotel has implemented administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing. These include access controls to the hotel management system through individual credentials, storage in data centers with restricted access, encryption of communications through a secure protocol (TLS/SSL), and training for staff who have access to guest information.

Notwithstanding the foregoing, no security or information-transmission system that relies on the internet can guarantee absolute security. Should a security breach occur that significantly affects your property or moral rights, the Hotel will notify you without delay, so that you may take appropriate action.

M. CHANGES TO THIS PRIVACY NOTICE

The Hotel may modify or update this Privacy Notice at any time, to address legislative developments, internal policies, or new requirements for providing its services. Any material change will be communicated through the website referenced in Section A, indicating the date of the last update. We recommend that you review it periodically.

N. COMPETENT AUTHORITY

If you believe that your right to personal data protection has been violated by any act or omission of the Hotel, or you suspect any violation of the applicable provisions on this matter, you may file a complaint with the competent authority for the protection of personal data held by private parties, which is currently the Secretaría Anticorrupción y Buen Gobierno, through its Dirección General de Datos Personales en el Sector Privado. For further information, you may consult that agency's official website.

Orchid House CoyoacánMexico City

A. IDENTITY OF THE DATA CONTROLLER

Proinmovilla, S.A. de C.V., together with its affiliates and/or subsidiaries, for the purposes of marketing the products and/or services that Orchid House Coyoacán manages and/or distributes (hereinafter referred to interchangeably as Orchid House Coyoacán or the Hotel), with address at Avenida Francisco Sosa número 277, Colonia Santa Catarina, Alcaldía Coyoacán, C.P. 04010, Mexico City, is a company committed to protecting your privacy.

Our Data Protection officer is the Marketing and Systems Department, located at the same address; you may contact it at the following email address: coyoacan@orchidhousehotels.com

This Privacy Notice applies to the following websites belonging to the Hotel:

a.- https://coyoacan.orchidhousehotels.com

B. PERSONAL DATA

For the purposes set out in this Privacy Notice, Orchid House Coyoacán may collect your personal data in various ways:

a.- When the information is provided directly by you;

b.- When you visit the Hotel's websites;

c.- When you use the services offered by the Hotel online, through the data you authorize the Hotel to take from your social media accounts (Facebook, X, LinkedIn, Google);

d.- When you connect to the Wi-Fi that Orchid House Coyoacán may offer you; or,

e.- When we obtain information through means other than those indicated above and permitted by applicable law.

The personal data obtained through the means indicated above are:

a.- Identification: name(s), surname(s), telephone number(s), marital status, email address, age, date of birth, gender, business name and RFC (tax ID) number, articles of incorporation with their latest amendment, power of attorney of the legal representative, among others. Preferences relating to lodging services and/or travel needs.

b.- Physical location: home address, tax address; reservation and/or stay dates, hotel, flight date and time.

c.- Authentication: username and password, handwritten signature, voice recording.

d.- Financial and asset data: bank card number, expiration date and security code, income level and occupation.

C. SENSITIVE PERSONAL DATA

Sensitive personal data are those personal data that affect the most intimate sphere of the data subject, or whose improper use may give rise to discrimination or entail a serious risk to that person. In particular, data that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions or sexual preferences are considered sensitive.

The Hotel does not collect sensitive personal data; should you require a particular service or product for which you provide such data, the Hotel will use it solely to provide that service and meet your specific needs.

In the event of a health emergency, the Hotel will, under the applicable regulations, collect data relating to your health status for the sole purpose of protecting your health and that of the other persons present at the hotel or at any property managed by Orchid House Hotels; such information will be kept only for as long as necessary to fulfill that purpose.

D. PURPOSE AND PROCESSING OF PERSONAL INFORMATION

Purposes that give rise to the legal relationship and are necessary for the provision of the service:

a.- The personal information you provide will be used by the Hotel to provide the services and/or products you request, or that form part of a program you have enrolled in or of a purchase you have made: reservations, purchase of vacation packages, vacation club membership, enrollment in our loyalty programs, enrollment in our referral programs, organization of events and social gatherings, purchase of tourism products and/or services; providing your data to the relevant supplier where applicable.

b.- The Hotel may use the personal information you provide in order to offer you better service and, where applicable, identify your preferences during your stay and make it more enjoyable.

Purposes that do not give rise to the legal relationship, are not necessary for the provision of the service, and which you consent to be carried out:

a.- The Hotel may likewise use the information to offer you promotions and tourism and commercial products, to send promotions, special services, newsletters, surveys, prize draws and other online contests, transferring your personal data to affiliated companies where applicable.

b.- Data analysis may be carried out using technology in order to build profiles relating to your stays and travel preferences, allowing us to evaluate our service and personalize the communications and promotions designed for you.

E. LIMITING THE USE OR DISCLOSURE OF PERSONAL INFORMATION WITH RESPECT TO PURPOSES THAT DO NOT GIVE RISE TO THE LEGAL RELATIONSHIP

So that you may limit the use and disclosure of your Personal Information with respect to purposes that do not give rise to the legal relationship, we offer the following means:

a.- If you are a resident of the United Mexican States, registering with the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad), administered by the Federal Consumer Protection Agency (PROFECO), so that your personal data is not used to receive advertising or promotions from goods or services companies. For further information, you may consult PROFECO's website or contact that agency directly.

b.- Submitting a request to the email address coyoacan@orchidhousehotels.com, indicating the email address(es) and/or telephone number(s) for which you request the limitation.

F. EXERCISING THE RIGHTS OF ACCESS, RECTIFICATION, CANCELLATION AND OBJECTION

Access, rectification, cancellation or objection with respect to the information you provide to the Hotel, as set out in the Federal Law on the Protection of Personal Data Held by Private Parties or in any applicable regulation, may be exercised by submitting a written request to the Marketing and Systems Department at the following address: Avenida Francisco Sosa número 277, Colonia Santa Catarina, Alcaldía Coyoacán, C.P. 04010, Mexico City, from 9:00 a.m. to 2:00 p.m., Monday through Friday, or to the email address coyoacan@orchidhousehotels.com.

Such request must contain at least the following:

(i) Name of the owner of the personal data;

(ii) Email address for receiving notifications;

(iii) Documents evidencing your identity or, where applicable, the legal representation of the data owner;

(iv) A clear and precise description of the personal data over which the right is to be exercised, and of the right that is intended to be exercised;

(v) Any other element or document that facilitates locating the personal data.

If the request does not meet any of the requirements indicated above, the Marketing and Systems Department may require you, within 5 days of receipt of the request, to provide the elements or documents necessary to process it. You will have 10 days to respond to that requirement; if you do not respond within that period, the request will be deemed not to have been submitted. Unless the applicable regulations provide otherwise, the response periods will be a maximum of 20 days from the date the request is received in order to communicate the determination adopted, so that, if it is well founded, it may be implemented within the 15 days following the issuance of the response. The foregoing periods may be extended once, for an equal period, provided the circumstances of the case so justify. In order to protect your confidentiality, the Hotel will send the response to your request to the email address you provided for that purpose and will keep it available to the applicant at the address indicated in the preceding paragraph.

G. REVOCATION OF CONSENT FOR THE USE OF YOUR PERSONAL DATA

You may revoke the consent you have granted us for the processing of your personal data. Please bear in mind that the Hotel will not be able to address your request or conclude it immediately in every case, since a legal obligation may require your personal data to continue being processed. You should also consider that, for certain purposes, revoking your consent will mean that we can no longer provide the service you requested, or the termination of your relationship with the Hotel. To revoke your consent, you must submit your request in writing to the Marketing and Systems Department at the following address: Avenida Francisco Sosa número 277, Colonia Santa Catarina, Alcaldía Coyoacán, C.P. 04010, Mexico City, from 9:00 a.m. to 2:00 p.m., Monday through Friday, or to the email address coyoacan@orchidhousehotels.com. Such request will be processed and handled in accordance with Section F above.

H. CONTROL AND SECURITY OF PERSONAL INFORMATION

The Hotel undertakes to take the necessary measures to protect the information collected, using security technologies and control procedures for the access, use or disclosure of your personal information without authorization — for example, by storing the personal information provided on servers located in Data Centers with limited access controls. For online transactions, we also use security technologies that protect the personal information transmitted to us through the various electronic means, such as the use of a secure server under the Secure Socket Layer (SSL) protocol. However, no security or data transmission system over which the company does not have absolute control and/or which depends on the internet can be guaranteed to be entirely secure.

I. ELECTRONIC MEANS AND COOKIES

Should you use electronic means in connection with your personal data, cookies will be generated in order to provide you with a better service. Cookies are small pieces of information sent by the website to your browser. Cookies are stored on your device's hard drive and are used to determine your preferences when you connect to the services of our sites, as well as to track certain behaviors or activities carried out by you within our sites. In some sections of our site we require the client to have cookies enabled, since some functionalities require them in order to work. Cookies allow us to:

a.- Recognize you when you enter our sites and offer you a personalized experience;

b.- Know the personal site settings specified by you — for example, cookies allow us to detect the bandwidth you selected upon entering the home page of our sites, so that we know what type of information it is advisable to download;

c.- Calculate the size of our audience and measure certain traffic parameters, since every browser that accesses our sites acquires a cookie used to determine the frequency of use and which sections of the sites are visited, thus reflecting your habits and preferences — information that is useful to us in improving content, headlines and promotions for users. Cookies also help us track certain activities; for example, in some of the surveys we launch online, we may use cookies to detect whether the user has already completed the survey and avoid displaying it again if they have.

The “help” button found on the toolbar of most browsers will tell you how to avoid accepting new cookies, how to have the browser notify you when it receives a new cookie, or how to disable all cookies. However, cookies allow you to take advantage of the most beneficial features we offer, so we recommend that you leave them enabled.

J. TRANSFERS

The Hotel only transfers personal data in the following cases:

a.- In the case of Mexico, in the circumstances established in Article 37 of the Federal Law on the Protection of Personal Data Held by Private Parties;

b.- Where another international regulation applies, data will only be transferred in the cases set out therein;

c.- Where it is necessary to provide it to third-party suppliers with respect to the services or products you are contracting, including the Cloudbeds hotel management system; and,

d.- Where you authorize the transmission of your data by physical or electronic means, such as “Google Signals”.

K. PERSONAL DATA RETENTION PERIOD

Your personal data will be retained for as long as the legal relationship with you is maintained, until it is satisfactorily concluded and provided that you do not exercise your right of erasure, or until you revoke your consent. In any case, the personal data retention period will be restricted to the minimum necessary, so that the data is retained only while the purpose for which it was collected remains. When its retention is no longer necessary, the Hotel will keep blocked any data that may be necessary during the legally established periods in order to address any matter relating to its processing or to the legal relationship originated with you. Once the legal periods have elapsed, the personal data will be deleted, adopting appropriate security measures to guarantee its total destruction.

L. CHANGES TO THIS PRIVACY NOTICE

The Hotel may update this privacy notice at any time. Should substantial changes be made to this notice, we will communicate them through our websites indicated in Section A of this Privacy Notice. We therefore suggest that you visit this privacy notice periodically in order to stay informed of any update.

M. VIDEO SURVEILLANCE

When you, in your capacity as Client, Supplier, Employee or Visitor, come to our facilities, you may be video recorded by the Hotel's security cameras, at the property located at Avenida Francisco Sosa número 277, Colonia Santa Catarina, Alcaldía Coyoacán, C.P. 04010, Mexico City.

The images and sounds captured by the cameras will be used for the security of both the company and the persons who visit us.

In the event of any disagreement or complaint regarding the processing of your personal data, you may address the competent authority for the protection of personal data held by private parties in Mexico, or the competent authority where a regulation other than the Mexican one applies.

Orchid House TulumTulum, Q. Roo

A. IDENTITY OF THE DATA CONTROLLER

Orchid Design, S.A. de C.V., together with its affiliates and/or subsidiaries, for the purposes of marketing the products and/or services that Orchid House Tulum Jungle manages and/or distributes (hereinafter referred to interchangeably as Orchid House Tulum Jungle or the Hotel), with corporate address at Avenida Campos Elíseos número 76, Colonia Polanco IV Sección, Alcaldía Miguel Hidalgo, C.P. 11560, Mexico City, and which operates the lodging establishment located at Calle Kinich Ná, Manzana 13, Lote 27, S/N, Balam Dzakab, Fraccionamiento Aldea Zamá, Sección F, C.P. 77760, Tulum, Quintana Roo, is a company committed to protecting your privacy.

Our Data Protection officer is the Marketing and Systems Department, located at the Hotel's address; you may contact it at the following email address: tulum@orchidhousehotels.com

This Privacy Notice applies to the following websites belonging to the Hotel:

a.- https://tulum.orchidhousehotels.com

B. PERSONAL DATA

For the purposes set out in this Privacy Notice, Orchid House Tulum Jungle may collect your personal data in various ways:

a.- When the information is provided directly by you;

b.- When you visit the Hotel's websites;

c.- When you use the services offered by the Hotel online, through the data you authorize the Hotel to take from your social media accounts (Facebook, X, LinkedIn, Google);

d.- When you connect to the Wi-Fi that Orchid House Tulum Jungle may offer you; or,

e.- When we obtain information through means other than those indicated above and permitted by applicable law.

The personal data obtained through the means indicated above are:

a.- Identification: name(s), surname(s), telephone number(s), marital status, email address, age, date of birth, gender, business name and RFC (tax ID) number, articles of incorporation with their latest amendment, power of attorney of the legal representative, among others. Preferences relating to lodging services and/or travel needs.

b.- Physical location: home address, tax address; reservation and/or stay dates, hotel, flight date and time.

c.- Authentication: username and password, handwritten signature, voice recording.

d.- Financial and asset data: bank card number, expiration date and security code, income level and occupation.

C. SENSITIVE PERSONAL DATA

Sensitive personal data are those personal data that affect the most intimate sphere of the data subject, or whose improper use may give rise to discrimination or entail a serious risk to that person. In particular, data that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions or sexual preferences are considered sensitive.

The Hotel does not collect sensitive personal data; should you require a particular service or product for which you provide such data, the Hotel will use it solely to provide that service and meet your specific needs.

In the event of a health emergency, the Hotel will, under the applicable regulations, collect data relating to your health status for the sole purpose of protecting your health and that of the other persons present at the hotel or at any property managed by Orchid House Hotels; such information will be kept only for as long as necessary to fulfill that purpose.

D. PURPOSE AND PROCESSING OF PERSONAL INFORMATION

Purposes that give rise to the legal relationship and are necessary for the provision of the service:

a.- The personal information you provide will be used by the Hotel to provide the services and/or products you request, or that form part of a program you have enrolled in or of a purchase you have made: reservations, purchase of vacation packages, vacation club membership, enrollment in our loyalty programs, enrollment in our referral programs, organization of events and social gatherings, purchase of tourism products and/or services; providing your data to the relevant supplier where applicable.

b.- The Hotel may use the personal information you provide in order to offer you better service and, where applicable, identify your preferences during your stay and make it more enjoyable.

Purposes that do not give rise to the legal relationship, are not necessary for the provision of the service, and which you consent to be carried out:

a.- The Hotel may likewise use the information to offer you promotions and tourism and commercial products, to send promotions, special services, newsletters, surveys, prize draws and other online contests, transferring your personal data to affiliated companies where applicable.

b.- Data analysis may be carried out using technology in order to build profiles relating to your stays and travel preferences, allowing us to evaluate our service and personalize the communications and promotions designed for you.

E. LIMITING THE USE OR DISCLOSURE OF PERSONAL INFORMATION WITH RESPECT TO PURPOSES THAT DO NOT GIVE RISE TO THE LEGAL RELATIONSHIP

So that you may limit the use and disclosure of your Personal Information with respect to purposes that do not give rise to the legal relationship, we offer the following means:

a.- If you are a resident of the United Mexican States, registering with the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad), administered by the Federal Consumer Protection Agency (PROFECO), so that your personal data is not used to receive advertising or promotions from goods or services companies. For further information, you may consult PROFECO's website or contact that agency directly.

b.- Submitting a request to the email address tulum@orchidhousehotels.com, indicating the email address(es) and/or telephone number(s) for which you request the limitation.

F. EXERCISING THE RIGHTS OF ACCESS, RECTIFICATION, CANCELLATION AND OBJECTION

Access, rectification, cancellation or objection with respect to the information you provide to the Hotel, as set out in the Federal Law on the Protection of Personal Data Held by Private Parties or in any applicable regulation, may be exercised by submitting a written request to the Marketing and Systems Department at the following address: Calle Kinich Ná, Manzana 13, Lote 27, S/N, Balam Dzakab, Fraccionamiento Aldea Zamá, Sección F, C.P. 77760, Tulum, Quintana Roo, from 9:00 a.m. to 2:00 p.m., Monday through Friday, or to the email address tulum@orchidhousehotels.com.

Such request must contain at least the following:

(i) Name of the owner of the personal data;

(ii) Email address for receiving notifications;

(iii) Documents evidencing your identity or, where applicable, the legal representation of the data owner;

(iv) A clear and precise description of the personal data over which the right is to be exercised, and of the right that is intended to be exercised;

(v) Any other element or document that facilitates locating the personal data.

If the request does not meet any of the requirements indicated above, the Marketing and Systems Department may require you, within 5 days of receipt of the request, to provide the elements or documents necessary to process it. You will have 10 days to respond to that requirement; if you do not respond within that period, the request will be deemed not to have been submitted. Unless the applicable regulations provide otherwise, the response periods will be a maximum of 20 days from the date the request is received in order to communicate the determination adopted, so that, if it is well founded, it may be implemented within the 15 days following the issuance of the response. The foregoing periods may be extended once, for an equal period, provided the circumstances of the case so justify. In order to protect your confidentiality, the Hotel will send the response to your request to the email address you provided for that purpose and will keep it available to the applicant at the address indicated in the preceding paragraph.

G. REVOCATION OF CONSENT FOR THE USE OF YOUR PERSONAL DATA

You may revoke the consent you have granted us for the processing of your personal data. Please bear in mind that the Hotel will not be able to address your request or conclude it immediately in every case, since a legal obligation may require your personal data to continue being processed. You should also consider that, for certain purposes, revoking your consent will mean that we can no longer provide the service you requested, or the termination of your relationship with the Hotel. To revoke your consent, you must submit your request in writing to the Marketing and Systems Department at the following address: Calle Kinich Ná, Manzana 13, Lote 27, S/N, Balam Dzakab, Fraccionamiento Aldea Zamá, Sección F, C.P. 77760, Tulum, Quintana Roo, from 9:00 a.m. to 2:00 p.m., Monday through Friday, or to the email address tulum@orchidhousehotels.com. Such request will be processed and handled in accordance with Section F above.

H. CONTROL AND SECURITY OF PERSONAL INFORMATION

The Hotel undertakes to take the necessary measures to protect the information collected, using security technologies and control procedures for the access, use or disclosure of your personal information without authorization — for example, by storing the personal information provided on servers located in Data Centers with limited access controls. For online transactions, we also use security technologies that protect the personal information transmitted to us through the various electronic means, such as the use of a secure server under the Secure Socket Layer (SSL) protocol. However, no security or data transmission system over which the company does not have absolute control and/or which depends on the internet can be guaranteed to be entirely secure.

I. ELECTRONIC MEANS AND COOKIES

Should you use electronic means in connection with your personal data, cookies will be generated in order to provide you with a better service. Cookies are small pieces of information sent by the website to your browser. Cookies are stored on your device's hard drive and are used to determine your preferences when you connect to the services of our sites, as well as to track certain behaviors or activities carried out by you within our sites. In some sections of our site we require the client to have cookies enabled, since some functionalities require them in order to work. Cookies allow us to:

a.- Recognize you when you enter our sites and offer you a personalized experience;

b.- Know the personal site settings specified by you — for example, cookies allow us to detect the bandwidth you selected upon entering the home page of our sites, so that we know what type of information it is advisable to download;

c.- Calculate the size of our audience and measure certain traffic parameters, since every browser that accesses our sites acquires a cookie used to determine the frequency of use and which sections of the sites are visited, thus reflecting your habits and preferences — information that is useful to us in improving content, headlines and promotions for users. Cookies also help us track certain activities; for example, in some of the surveys we launch online, we may use cookies to detect whether the user has already completed the survey and avoid displaying it again if they have.

The “help” button found on the toolbar of most browsers will tell you how to avoid accepting new cookies, how to have the browser notify you when it receives a new cookie, or how to disable all cookies. However, cookies allow you to take advantage of the most beneficial features we offer, so we recommend that you leave them enabled.

J. TRANSFERS

The Hotel only transfers personal data in the following cases:

a.- In the case of Mexico, in the circumstances established in Article 37 of the Federal Law on the Protection of Personal Data Held by Private Parties;

b.- Where another international regulation applies, data will only be transferred in the cases set out therein;

c.- Where it is necessary to provide it to third-party suppliers with respect to the services or products you are contracting, including the Cloudbeds hotel management system; and,

d.- Where you authorize the transmission of your data by physical or electronic means, such as “Google Signals”.

K. PERSONAL DATA RETENTION PERIOD

Your personal data will be retained for as long as the legal relationship with you is maintained, until it is satisfactorily concluded and provided that you do not exercise your right of erasure, or until you revoke your consent. In any case, the personal data retention period will be restricted to the minimum necessary, so that the data is retained only while the purpose for which it was collected remains. When its retention is no longer necessary, the Hotel will keep blocked any data that may be necessary during the legally established periods in order to address any matter relating to its processing or to the legal relationship originated with you. Once the legal periods have elapsed, the personal data will be deleted, adopting appropriate security measures to guarantee its total destruction.

L. CHANGES TO THIS PRIVACY NOTICE

The Hotel may update this privacy notice at any time. Should substantial changes be made to this notice, we will communicate them through our websites indicated in Section A of this Privacy Notice. We therefore suggest that you visit this privacy notice periodically in order to stay informed of any update.

M. VIDEO SURVEILLANCE

When you, in your capacity as Client, Supplier, Employee or Visitor, come to our facilities, you may be video recorded by the Hotel's security cameras, at the property located at Calle Kinich Ná, Manzana 13, Lote 27, S/N, Balam Dzakab, Fraccionamiento Aldea Zamá, Sección F, C.P. 77760, Tulum, Quintana Roo.

The images and sounds captured by the cameras will be used for the security of both the company and the persons who visit us.

In the event of any disagreement or complaint regarding the processing of your personal data, you may address the competent authority for the protection of personal data held by private parties in Mexico, or the competent authority where a regulation other than the Mexican one applies.

Solaya Boutique HotelTulum Hotel Zone

A. IDENTITY OF THE DATA CONTROLLER

My Way Luxury Resort, [S.A. de C.V.], together with its affiliates and/or subsidiaries, for the purposes of marketing the products and/or services that Solaya Boutique Hotel manages and/or distributes (hereinafter referred to interchangeably as Solaya Boutique Hotel or the Hotel), with address at Carretera Tulum–Boca Paila Kilómetro 8.5, Parcela 1427, Ejido José María Pino Suárez, C.P. 77789, Tulum, Quintana Roo, is a company committed to protecting your privacy.

Our Data Protection officer is the Marketing and Systems Department, located at the same address; you may contact it at the following email address: beach@orchidhousehotels.com

This Privacy Notice applies to the following websites belonging to the Hotel:

a.- https://solaya.orchidhousehotels.com

B. PERSONAL DATA

For the purposes set out in this Privacy Notice, Solaya Boutique Hotel may collect your personal data in various ways:

a.- When the information is provided directly by you;

b.- When you visit the Hotel's websites;

c.- When you use the services offered by the Hotel online, through the data you authorize the Hotel to take from your social media accounts (Facebook, X, LinkedIn, Google);

d.- When you connect to the Wi-Fi that Solaya Boutique Hotel may offer you; or,

e.- When we obtain information through means other than those indicated above and permitted by applicable law.

The personal data obtained through the means indicated above are:

a.- Identification: name(s), surname(s), telephone number(s), marital status, email address, age, date of birth, gender, business name and RFC (tax ID) number, articles of incorporation with their latest amendment, power of attorney of the legal representative, among others. Preferences relating to lodging services and/or travel needs.

b.- Physical location: home address, tax address; reservation and/or stay dates, hotel, flight date and time.

c.- Authentication: username and password, handwritten signature, voice recording.

d.- Financial and asset data: bank card number, expiration date and security code, income level and occupation.

C. SENSITIVE PERSONAL DATA

Sensitive personal data are those personal data that affect the most intimate sphere of the data subject, or whose improper use may give rise to discrimination or entail a serious risk to that person. In particular, data that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions or sexual preferences are considered sensitive.

The Hotel does not collect sensitive personal data; should you require a particular service or product for which you provide such data, the Hotel will use it solely to provide that service and meet your specific needs.

In the event of a health emergency, the Hotel will, under the applicable regulations, collect data relating to your health status for the sole purpose of protecting your health and that of the other persons present at the hotel or at any property managed by Orchid House Hotels; such information will be kept only for as long as necessary to fulfill that purpose.

D. PURPOSE AND PROCESSING OF PERSONAL INFORMATION

Purposes that give rise to the legal relationship and are necessary for the provision of the service:

a.- The personal information you provide will be used by the Hotel to provide the services and/or products you request, or that form part of a program you have enrolled in or of a purchase you have made: reservations, purchase of vacation packages, vacation club membership, enrollment in our loyalty programs, enrollment in our referral programs, organization of events and social gatherings, purchase of tourism products and/or services; providing your data to the relevant supplier where applicable.

b.- The Hotel may use the personal information you provide in order to offer you better service and, where applicable, identify your preferences during your stay and make it more enjoyable.

Purposes that do not give rise to the legal relationship, are not necessary for the provision of the service, and which you consent to be carried out:

a.- The Hotel may likewise use the information to offer you promotions and tourism and commercial products, to send promotions, special services, newsletters, surveys, prize draws and other online contests, transferring your personal data to affiliated companies where applicable.

b.- Data analysis may be carried out using technology in order to build profiles relating to your stays and travel preferences, allowing us to evaluate our service and personalize the communications and promotions designed for you.

E. LIMITING THE USE OR DISCLOSURE OF PERSONAL INFORMATION WITH RESPECT TO PURPOSES THAT DO NOT GIVE RISE TO THE LEGAL RELATIONSHIP

So that you may limit the use and disclosure of your Personal Information with respect to purposes that do not give rise to the legal relationship, we offer the following means:

a.- If you are a resident of the United Mexican States, registering with the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad), administered by the Federal Consumer Protection Agency (PROFECO), so that your personal data is not used to receive advertising or promotions from goods or services companies. For further information, you may consult PROFECO's website or contact that agency directly.

b.- Submitting a request to the email address beach@orchidhousehotels.com, indicating the email address(es) and/or telephone number(s) for which you request the limitation.

F. EXERCISING THE RIGHTS OF ACCESS, RECTIFICATION, CANCELLATION AND OBJECTION

Access, rectification, cancellation or objection with respect to the information you provide to the Hotel, as set out in the Federal Law on the Protection of Personal Data Held by Private Parties or in any applicable regulation, may be exercised by submitting a written request to the Marketing and Systems Department at the following address: Carretera Tulum–Boca Paila Kilómetro 8.5, Parcela 1427, Ejido José María Pino Suárez, C.P. 77789, Tulum, Quintana Roo, from 9:00 a.m. to 2:00 p.m., Monday through Friday, or to the email address beach@orchidhousehotels.com.

Such request must contain at least the following:

(i) Name of the owner of the personal data;

(ii) Email address for receiving notifications;

(iii) Documents evidencing your identity or, where applicable, the legal representation of the data owner;

(iv) A clear and precise description of the personal data over which the right is to be exercised, and of the right that is intended to be exercised;

(v) Any other element or document that facilitates locating the personal data.

If the request does not meet any of the requirements indicated above, the Marketing and Systems Department may require you, within 5 days of receipt of the request, to provide the elements or documents necessary to process it. You will have 10 days to respond to that requirement; if you do not respond within that period, the request will be deemed not to have been submitted. Unless the applicable regulations provide otherwise, the response periods will be a maximum of 20 days from the date the request is received in order to communicate the determination adopted, so that, if it is well founded, it may be implemented within the 15 days following the issuance of the response. The foregoing periods may be extended once, for an equal period, provided the circumstances of the case so justify. In order to protect your confidentiality, the Hotel will send the response to your request to the email address you provided for that purpose and will keep it available to the applicant at the address indicated in the preceding paragraph.

G. REVOCATION OF CONSENT FOR THE USE OF YOUR PERSONAL DATA

You may revoke the consent you have granted us for the processing of your personal data. Please bear in mind that the Hotel will not be able to address your request or conclude it immediately in every case, since a legal obligation may require your personal data to continue being processed. You should also consider that, for certain purposes, revoking your consent will mean that we can no longer provide the service you requested, or the termination of your relationship with the Hotel. To revoke your consent, you must submit your request in writing to the Marketing and Systems Department at the following address: Carretera Tulum–Boca Paila Kilómetro 8.5, Parcela 1427, Ejido José María Pino Suárez, C.P. 77789, Tulum, Quintana Roo, from 9:00 a.m. to 2:00 p.m., Monday through Friday, or to the email address beach@orchidhousehotels.com. Such request will be processed and handled in accordance with Section F above.

H. CONTROL AND SECURITY OF PERSONAL INFORMATION

The Hotel undertakes to take the necessary measures to protect the information collected, using security technologies and control procedures for the access, use or disclosure of your personal information without authorization — for example, by storing the personal information provided on servers located in Data Centers with limited access controls. For online transactions, we also use security technologies that protect the personal information transmitted to us through the various electronic means, such as the use of a secure server under the Secure Socket Layer (SSL) protocol. However, no security or data transmission system over which the company does not have absolute control and/or which depends on the internet can be guaranteed to be entirely secure.

I. ELECTRONIC MEANS AND COOKIES

Should you use electronic means in connection with your personal data, cookies will be generated in order to provide you with a better service. Cookies are small pieces of information sent by the website to your browser. Cookies are stored on your device's hard drive and are used to determine your preferences when you connect to the services of our sites, as well as to track certain behaviors or activities carried out by you within our sites. In some sections of our site we require the client to have cookies enabled, since some functionalities require them in order to work. Cookies allow us to:

a.- Recognize you when you enter our sites and offer you a personalized experience;

b.- Know the personal site settings specified by you — for example, cookies allow us to detect the bandwidth you selected upon entering the home page of our sites, so that we know what type of information it is advisable to download;

c.- Calculate the size of our audience and measure certain traffic parameters, since every browser that accesses our sites acquires a cookie used to determine the frequency of use and which sections of the sites are visited, thus reflecting your habits and preferences — information that is useful to us in improving content, headlines and promotions for users. Cookies also help us track certain activities; for example, in some of the surveys we launch online, we may use cookies to detect whether the user has already completed the survey and avoid displaying it again if they have.

The “help” button found on the toolbar of most browsers will tell you how to avoid accepting new cookies, how to have the browser notify you when it receives a new cookie, or how to disable all cookies. However, cookies allow you to take advantage of the most beneficial features we offer, so we recommend that you leave them enabled.

J. TRANSFERS

The Hotel only transfers personal data in the following cases:

a.- In the case of Mexico, in the circumstances established in Article 37 of the Federal Law on the Protection of Personal Data Held by Private Parties;

b.- Where another international regulation applies, data will only be transferred in the cases set out therein;

c.- Where it is necessary to provide it to third-party suppliers with respect to the services or products you are contracting, including the Cloudbeds hotel management system; and,

d.- Where you authorize the transmission of your data by physical or electronic means, such as “Google Signals”.

K. PERSONAL DATA RETENTION PERIOD

Your personal data will be retained for as long as the legal relationship with you is maintained, until it is satisfactorily concluded and provided that you do not exercise your right of erasure, or until you revoke your consent. In any case, the personal data retention period will be restricted to the minimum necessary, so that the data is retained only while the purpose for which it was collected remains. When its retention is no longer necessary, the Hotel will keep blocked any data that may be necessary during the legally established periods in order to address any matter relating to its processing or to the legal relationship originated with you. Once the legal periods have elapsed, the personal data will be deleted, adopting appropriate security measures to guarantee its total destruction.

L. CHANGES TO THIS PRIVACY NOTICE

The Hotel may update this privacy notice at any time. Should substantial changes be made to this notice, we will communicate them through our websites indicated in Section A of this Privacy Notice. We therefore suggest that you visit this privacy notice periodically in order to stay informed of any update.

M. VIDEO SURVEILLANCE

When you, in your capacity as Client, Supplier, Employee or Visitor, come to our facilities, you may be video recorded by the Hotel's security cameras, at the property located at Carretera Tulum–Boca Paila Kilómetro 8.5, Parcela 1427, Ejido José María Pino Suárez, C.P. 77789, Tulum, Quintana Roo.

The images and sounds captured by the cameras will be used for the security of both the company and the persons who visit us.

In the event of any disagreement or complaint regarding the processing of your personal data, you may address the competent authority for the protection of personal data held by private parties in Mexico, or the competent authority where a regulation other than the Mexican one applies.