COMPREHENSIVE PRIVACY NOTICE FOR CLIENTS

In accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter “The Law") and its Regulations, this Privacy Notice is issued in the following terms:

1.- RESPONSIBLE.

CLUB REAL RESORT, S.A. de C.V (known commercially and hereinafter as “CLUB REAL RESORT”), legal entity, duly constituted in accordance with the laws of the Mexican Republic, domiciled in Avenida Bonampak, Supermanzana 10, Manzana 2, Lot 7, Tower “A”, first floor, 5-A, Zip Code 77500 in the city of Cancún, Quintana Roo, is the entity responsible for the use and protection of your personal data. which will be treated based on the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility in terms of the Law; In this regard, we inform you of the following:

2.- PERSONAL DATA THAT WILL BE COLLECTED AND SUBJECTED TO TREATMENT.

For the purposes indicated in this Privacy Notice, your data will be collected from the following sources: provided directly by you in person, by telephone, by email, as well as through our website. https://realclubresorts.com/ . The personal data we obtain are the following:

• Identification and Contact Data.- Full name, age, sex, address, marital status, telephone numbers, place and date of birth, occupation, company for which you work, nationality, social security number, Unique Population Registry Code (CURP) or its equivalent for foreign citizens , email, Federal Taxpayer Registry (RFC) or its equivalent for foreign citizens, handwritten signature, official identification, names of family members and any other document that is essential to identify you. ‍
• Identification and contact data of third parties with whom you have a relationship.- Name, telephone number, email address, relationship with you and any other information that is necessary to identify the people designated as beneficiaries or, if applicable, to be contacted in emergency cases. ‍
• Financial and Asset Data.- Data that is necessary to satisfactorily comply with the services provided, such as: amount of monthly or annual income received, names of branch and banking institution, bank account number(s) and credit and/or debit card information.

CLUB REAL RESORT will also request and process data that “The Law” considers sensitive, which are mentioned below and which from now on will be understood to be included within the term “Personal Data”.

Sensitive Data: Health status.

The sensitive personal data collected will be processed for the fulfillment of the purposes identified in this Privacy Notice and particularly, for the provision of services offered by CLUB REAL RESORT whose nature requires that it have specific measures to ensure the well-being and/or health of our members.

CLUB REAL RESORT You may also process sensitive personal data related to your health status when these are provided by you for the provision of special services or assistance provided as part of the Inspira Vacaciones program.^® and when this is strictly necessary, we will request your express written consent for the processing of said sensitive personal data, through means that adequately inform about said processing.

• Image for video surveillance purposes. CLUB REAL RESORT prioritizes security in its facilities, which is why there is a video surveillance system for the safety of clients, workers and people who visit its facilities. This system will collect your personal image on equipment and servers operated under the strictest confidentiality, these data will be used only for purposes related to the preservation of the safety and well-being of all people.

3.- PURPOSES OF THE PROCESSING OF YOUR DATA.

We will use the personal data that we collect from you for the following purposes, which are necessary for the service you request:

• Register them in our database as a client of our services.
• For the fulfillment of administrative purposes related to the performance of contractual obligations contracted.
• Offer our clients the best quality service.
• Manage charges and collections via bank cards.
• Follow up and attend to customer requirements.
• Process your requests, and therefore manage the relationship you want to establish with CLUB REAL RESORT, or maintain the relationship already established.
• Verify your identity when registering and/or paying for services through our website.
• Notify you of changes to our service.
• Billing and collection of the services and products provided, where appropriate the collection of said services or products judicially or extrajudicially.
• Video surveillance for security purposes of people in our facilities.

4.- ADDITIONAL PURPOSES.

Additionally, we will use your personal information for the following secondary purposes that are not essential for the requested service, but that allow and facilitate us to provide you with better service:

• Marketing, advertising or commercial prospecting purposes, including sending promotions or advertising material. Market satisfaction surveys, consumer statistics or other forms for the evaluation of our products and services.

• If you do not want your personal data to be used for these additional purposes, you may deny your consent by email that you can send at this time by clicking on the following address: datos@grupobd.mx.

5.- TRANSFERS OF PERSONAL DATA.

Your personal data may be transferred and processed by persons other than CLUB REAL RESORT. The recipients of said transfers (national or international) belong to the following categories:

to). Holding companies, subsidiaries or affiliates of CLUB REAL RESORT for the purposes of centralized storage of information, control of registrations and cancellations, changes in your service reservation; as well as for the compilation of customer statistics. CLUB REAL RESORT in order to evaluate, improve and design new services for our clients and improve the quality of our products and services.

b). Third parties, solely and exclusively for the purpose of any service provider assisting CLUB REAL RESORT in the fulfillment of the services requested or expressly contracted by the client, as well as for the purposes of identification, contact and to better understand their needs and achieve better service.

CLUB REAL RESORT will be kept for as long as The Law applicable permits, the information in its database in order to simplify the provision of the service.

6.- CONSENT FOR DATA TRANSFER.

The transfers of personal data referred to in the sections mentioned in the previous section do not require your consent to be carried out, in accordance with the provisions of article 37 of the Law.

You can contact CLUB REAL RESORT through our Personal Data Department, at any time and express your wish to withdraw consent for the future transfer of your personal data.

7.  COOKIES AND WEB BEACONS .

We inform you that we do not collect personal data through the use of Cookies or Web Beacons, and other technologies to obtain personal information from you, such as the following:

• Your browser type and operating system.
• The Internet pages you visit.
• The links you follow.
• The IP address.
• The site you visited before entering ours.

8.- ARCO RIGHTS (Access, Rectification, Cancellation or Opposition).

You, as the owner of the Personal Data that CLUB REAL RESORT collects, you have the right to request Access, Rectification, Cancellation or Opposition regarding any data you have provided to us. For clarity, we provide you with the following definitions:

Access.- It is the right that you have to access your data and know which of them are being used in accordance with the purposes for which they were collected.

Rectification.- It is the right that you have to request the rectification or correction of your data if it is incorrect.

Cancellation.- It is your right to request that your data be deleted from the database of CLUB REAL RESORT when you consider that they are not being treated in accordance with the provisions of this Privacy Notice or the Law and its regulations. The cancellation request may be for all of your data or only some of it.

Opposition.- It is the right that you have to oppose the processing of your Personal Data or to demand the interruption of its use.

The exercise of any of the aforementioned rights does not limit or exclude the possibility of exercising any of the others, nor is there an order of execution; Therefore, the execution of one of them will not be a requirement for the execution of the others. However, the Law establishes circumstances in which it will not be possible to comply with your request, particularly in the case of requests regarding Opposition and/or Cancellation.

You may submit your request to exercise your ARCO rights at any time and free of charge, either on your own or through your legal representative, for which you must fill out the form called “ARCO Rights Request”. Download the ARCO Rights Request Form.

Applications for ARCO Rights may be submitted digitally via email sent to the address datos@grupobd.mx, all requests must contain the following information:

• Your name, your address and the means by which we can inform you of the response to your request.
• Documents that prove your identity or that of your legal representative (official identification, power of attorney).
• The detailed description of the Personal Data that you wish to submit to any of the aforementioned rights.
• If any, additional elements that facilitate the location of your Personal Data.
• In the event of a rectification request, the modifications to be made and the documentation that supports your request.

Within a maximum period of 20 (twenty) business days, counted from the date on which you made your request, CLUB REAL RESORT will send you a response through the means that you have indicated in your request and, if appropriate, the approved resolution will be applied within a maximum period of 15 (fifteen) days from the date CLUB REAL RESORT would have communicated that response.

In the case of requests for access to your Personal Data, these will be considered duly completed at the time in which CLUB REAL RESORT make the requested information available to you, by any means or format.

Requests for ARCO Rights may be made by people other than you as long as the designated person certifies:

• The identity of you as the owner of the data that will be the subject of the request.
• The identity of your legal representative.
• The existence of the representation either through a public deed, a power of attorney signed before two witnesses or that you declare it personally.

The request and delivery of Personal Data will be free; However, the applicant will be obliged to cover the costs of shipping, certification, copies or reproductions in other formats.

As mentioned before, The Law establishes circumstances in which CLUB REAL RESORT may deny any request regarding ARCO Rights, for more information in this regard, we suggest you review article 34 (thirty-four) of the Federal Law on Protection of Personal Data Held by Private Parties.

For any questions regarding the processing of your Personal Data, you must contact the Personal Data department of CLUB REAL RESORT via email datos@grupobd.mx or by telephone at (998) 272 8040 EXT. 5292 during business hours Monday to Friday from 9:00 a.m. to 1:00 p.m.  

9.- MECHANISMS AND PROCEDURES FOR THE OWNER, IF APPROPRIATE, TO REVOKE HIS CONSENT AT ANY TIME.

You may revoke your consent for the processing of your personal data, without retroactive effect, in all those cases in which such revocation does not imply the impossibility of complying with obligations derived from a legal relationship in force between you and CLUB REAL RESORT.

The procedure for revoking consent, if applicable, will be the same as that established in point number 7 of this Privacy Notice, related to the exercise of ARCO rights.

10.- OPTIONS TO LIMIT THE USE OF YOUR PERSONAL DATA.

You may limit the use or disclosure of your personal data by directing the corresponding request to our Personal Data Department. The requirements to prove your identity, as well as the procedure to respond to your request, will be the same as those indicated for the exercise of ARCO rights mentioned in point number 7 of this Privacy Notice.

In order for you to limit the use and disclosure of your personal information, we offer you the following means:

• Registration in the Public Registry to Avoid Advertising (REPEP), a registry dependent on the Federal Consumer Protection Agency whose purpose is to ensure that user data is not used for marketing or advertising purposes through telephone calls and text messages.

• Registration in the Public Registry of Users, a registry that contains information on Users of the Mexican Financial System who do not wish to be bothered with advertising and promotions from financial institutions.

11.- SECURITY MEASURES IMPLEMENTED.

To protect your personal data, we have implemented administrative, physical and technical security measures in order to avoid loss, misuse or alteration of your information.

When we communicate or share your information with third parties that provide us with a service, we require and verify that they have the necessary security measures to protect your personal data, prohibiting the use of your personal information for purposes other than those assigned; the foregoing with the understanding that notwithstanding the foregoing, any non-compliance by said third parties with the provisions of the Law and its Regulations is the exclusive responsibility of said third parties.

12.- MODIFICATIONS TO THE PRIVACY NOTICE.

CLUB REAL RESORT may modify, update, extend or otherwise change the content and scope of this Privacy Notice, at any time and under its sole discretion. In that sense, we will publish these changes on the internet portal https://www.grupobd.mx/privacidad,  

13.- COMPLAINTS.

If you consider that your right to protection of personal data has been violated or you presume that the processing of your personal data exists in violation of the provisions set forth in the Federal Law on Protection of Personal Data Held by Private Parties or its Regulations, you may file the corresponding complaint or report with the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI). For more information visit the website: https://home.inai.org.mx/.