COMPREHENSIVE NOTICE OF PRIVACY FOR CLIENTS

In compliance with Articles 15, 16, and other applicable provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter referred to as “the Law”) and its Regulations, this Privacy Notice is made available to interested parties.

1.- IDENTITY AND ADDRESS OF THE CONTROLLER.

ATELIER DE HOTELES, S.A. de C.V. (hereinafter referred to as “ADH”) is a company that has been duly incorporated in accordance with Mexican law, with its address at Avenida Bonampak, Supermanzana 10, Manzana 2, Lote 7, fourth floor, Torre "B", Zip Code 77500, Cancun, Quintana Roo, Mexico. ADH is responsible for processing the personal data provided us, which will be protected according to the provisions of the Law, its Regulations and the Notice of Privacy Guidelines.

2.- PERSONAL DATA TO BE COLLECTED AND SUBJECT TO PROCESSING.

Based on the legal relationship you have established with ADH, the company will collect and process the following data:

• Identification and contact data: Full name, age, sex, address, marital status, telephones, place and date of birth, occupation, company of employment, nationality, social security number, Population Registration ID or their equivalent for foreign citizens, handwritten signature, official identification, migratory documents, academic information, names of family members or any other document that is essential for identifying you.
• ‍Financial and asset-related data: Data which is necessary to successfully fulfill the services provided, such as branch and bank institution names, bank account number(s), and credit card details.
• ADH may also request and process data considered sensitive under “The Law”, which is listed below and will henceforth be included within the term, “Personal Data”.
• ‍Images for video surveillance purposes: ADH prioritizes security on its premises, which is why there is a video surveillance system to ensure the safety of customers, employees, and visitors to the locations where ADH operates. This system will collect your personal image through equipment and servers operated under strict confidentiality. This data will be used solely for purposes related to maintaining the safety and well-being of all individuals.

3.- PURPOSES OF THE PROCESSING OF COLLECTED DATA.

This document is intended to define the scope and general conditions for the use and processing that ADH will carry out regarding your Personal Data. The collection, use, handling, utilization, storage, disclosure, and transfer of your data aims to fulfill the necessary purposes outlined below:

• To register you on our database as a user of our services.
• To offer you assistance, information regarding our products and/or services, as well as to follow up on the requests you submit to us, and where applicable, to send you the price estimate for potential contracting of services.
• To verify your identity when subscribing to any of our websites, newsletters, services, advertising programs, or any others that we may implement in the future.
• To notify you of changes in the terms of use or modification of this privacy notice.
• Video surveillance is for the safety of the individuals who visit our facilities.  

Additionally, ADH may use your information for the following non-essential purposes:  

• For applying surveys and evaluations.
• To send you information about special offers, products and services, either our own or from third parties that are related to those offered by us.

If you do not wish your personal data to be used for these additional purposes, you may deny your consent by sending an email, which you can send right now by clicking on this address: datos@grupobd.mx.

4.- TRANSFER OF PERSONAL DATA.

You are hereby informed that, in accordance with Article 37 (Thirty-Seven) of the Law, ADH may transfer your personal data to third parties, whether domestic or foreign. These transfers are made for your benefit and are essential in order to protect your personal data or to comply with legal requirements; therefore, your authorization will be necessary to carry them out.

The following are companies or entities other than ADH to which we may transfer your Personal Data:

‍

ADH informs you that it does not make transfers that are not in accordance with the provisions of Article 37 (Thirty-Seven) of "The Law." In the eventuality that ADH decides to change this policy, you will be duly informed through the means and procedures outlined hereinafter, and you will be provided with the necessary tools to authorize or prohibit transfers that are not deemed essential.  

5.- ARCO RIGHTS, MEANING AND PROCEDURE FOR EXERCISING THEM.

You, as the owner of the Personal Data collected by ADH, have the right to request Access, Rectification, Cancellation, or Opposition regarding any data you have provided to us. For further clarity, below we provide the following definitions:

Access.- The right you have to access your data and know which of them are being used in accordance with the purposes for which they were collected.

Rectification.- The right you have to request correction or modification of your data if they are incorrect.

Cancellation.- The right you have to request the deletion of your data from ADH's database when you believe they are not being processed in accordance with this Privacy Notice or with the Law and its regulations. The cancellation request can apply to all your data or only some of it.

Opposition.- The right you have to object to the processing of your Personal Data or to demand the cessation of its use.

Exercising any of the aforementioned rights does not limit or exclude the possibility of exercising any of the others, nor is there a specific order of execution; therefore, the exercise of one right will not be a requirement for exercising the others. However, the Law establishes circumstances in which it will not be possible to comply with your request, particularly in the case of requests related to Opposition and/or Cancellation.

You may submit your request to exercise your ARCO rights at any time and free of charge, either on your own behalf or through your legal representative. To do so, you must fill out the form titled "ARCO Rights Request," Download the ARCO Rights Request Form.

ARCO Rights requests may be submitted digitally via email sent to the address datos@grupobd.mx, All requests must contain the following information:

• Your name, address, and the method through which we can inform you of the response to your request.
• Documents that verify your identity or that of your legal representative (official ID’s, power of attorney).
• A detailed description of the Personal Data you wish to subject to any of the aforementioned rights.
• Additional information that will help locate your Personal Data.
• In the case of a request for rectification, the modifications to be made and the documentation supporting your request.

Within a maximum period of 20 (twenty) business days from the date you made your request, ADH will send you a response through the means you specified in your request. If applicable, the approved resolution will be implemented within a maximum of 15 (fifteen) days from the date ADH communicated the response to you.

In the case of requests for access to your Personal Data, these will be considered as duly completed when ADH makes the requested information available to you, through any means or format.

ARCO Rights requests may be made by individuals other than yourself, provided that the designated person proves:

• Your identity as the owner of the data that will be subject to the request.
• The identity of your legal representative.
• The existence of the representation, either through a public document, a power of attorney signed in the presence of two witnesses, or through your personal declaration.

The request and delivery of Personal Data will be free of charge; however, the requesting party will be required to cover the costs of shipping, certification, copies, or reproductions in other formats.

As mentioned earlier, the Law establishes circumstances in which ADH may deny a request related to ARCO Rights. For more information on this, we suggest reviewing Article 34 (Thirty-Four) of the Federal Law on the Protection of Personal Data Held by Private Parties.

For any questions regarding the processing of your Personal Data, contact the Personal Data Department of ADH via email at datos@grupobd.mx or by phone at (998) 272 8040 ext. 5292 during business hours, Monday through Friday, from 9:00 a.m. to 1:00 p.m.

6.- REVOCATION OF CONSENT FOR THE PROCESSING OF YOUR DATA.

You may, at any time, revoke the consent you have granted to ADH for the processing of your Personal Data; however, you should be aware that revocation of consent for processing represents the definitive cessation of the use of information and it would mean a termination of the relationship between you and ADH.

You may personally submit your revocation request via email to datos@grupobd.mx, in which you should include your name, attach a copy of your official identification, and specify the method through which we can inform you of the response to your request. You may also request this through your legal representative, provided the designated person meets the requirements specified for ARCO Rights requests.

The deadlines, hours, and response mechanisms will be the same as those established for ARCO Rights requests.

7.- USE OF COOKIES AND WEB BEACONS.

We inform you that we do not collect personal data through the use of Cookies or Web Beacons and other technologies to obtain personal information from you, such as the following:

• Your type of browser and operating system.
• The webpages you visit.
• The links you follow.
• The IP address.
• The site you visited before entering ours.

8.- MEANS FOR LIMITING THE USE OR DISCLOSURE OF YOUR PERSONAL DATA.

ADH will not use or disclose your personal data for purposes other than those strictly necessary for fulfilling the relationship between you and ADH, always in accordance with the guidelines described in this Privacy Notice.

If you believe that ADH is using or disclosing your Personal Data for purposes other than those described in this document, you may exercise any of the ARCO Rights of which you have previously been informed. Additionally, as general information, you are hereby informed that you have the following options to restrict the sending of unauthorized advertising:

• Registration with the Public Registry to Avoid Publicity (REPEP), a registry managed by the Federal Consumer Protection Agency, aimed at ensuring that users’ data is not used for marketing or advertising purposes through phone calls and text messages.
• Registration with the Public Registry of Users, a registry that contains information about Users of the Mexican Financial System who do not wish to be bothered by advertising promotions from financial institutions.

9.- CHANGES TO THE PRIVACY NOTICE.

This Notice of Privacy may be subject to modifications, changes, or updates as necessary to remain in accordance with legal provisions regarding Personal Data. If applicable, ADH will inform you of any changes by publishing them on this page.

10.- CONSENT.

By accessing and using our website, you acknowledge that you have read the content of this Privacy Notice, are aware of the legal implications as well as your rights regarding Personal Data, and that you expressly consent to the processing of your Personal Data and transfers to third parties under the terms stated in this Privacy Notice.

11.-COMPLAINTS AND GRIEVANCES.

If you believe that your right to personal data protection has been violated, or suspect that there has been a breach in the processing of your personal data in violation of the provisions set forth in the Federal Law on the Protection of Personal Data Held by Private Parties or its Regulations, you may file the corresponding complaint or report with the National Institute for Transparency, Access to Information, and Protection of Personal Data (INAI). For more information, please visit the website: https://home.inai.org.mx.