COMPREHENSIVE NOTICE OF PRIVACY FOR SUPPLIERS

In compliance with Articles 15, 16, and other applicable provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter referred to as the “Law”) and its Regulations, this Privacy Notice is made available to interested parties under the following terms:

1.- IDENTITY AND ADDRESS OF THE CONTROLLER.

Club Real Resort, S.A. de C.V. (hereinafter referred to as “CLUB REAL RESORT”) is a business corporation that has been duly incorporated under the laws of the Mexican Republic, a member of Grupo BD, with address at Av. Bonampak, Supermanzana 10, Manzana 2, Lote 7, Fourth Floor, Torre “A”, Zip Code 77500, Cancun, Quintana Roo, Mexico. CLUB REAL RESORT, is the controller responsible for the use and protection of your personal data. This data will be processed based on the principles of legality, consent, information, quality, purpose, fairness, proportionality, and accountability in accordance with the Law; in this regard, we inform you of the following:  

2.- PERSONAL DATA TO BE COLLECTED AND SUBJECT TO PROCESSING.  

For the purposes outlined in this Privacy Notice, your data will be collected from the following sources: provided directly by you in person, via telephone, or through email. The personal data we obtain is as follows:

The personal data we obtain from you directly and personally are those collected physically when you enter the premises of CLUB REAL RESORT.  

The data we obtain:

• Identification and Contact Data.- Full name, age, gender, address and data on the proof of address, telephone numbers, company where you work, nationality, social security number, Population Registration ID (CURP) or its equivalent for foreign nationals, email, Federal Taxpayer Registry (RFC) or its equivalent for foreign nationals, handwritten signature, official identification with photograph, migration documents, academic data, names of family members, and any other document that is essential for identifying you. This may include fingerprints, video surveillance recordings, or any other method of control that is determined during your visit to our premises.
• ‍Legal information.- Legal powers granted to individuals who represent you or powers granted to you for representing individual and/or legal entities, including articles of incorporation for corporate entities, where applicable.
• ‍Financial, Asset-Related and Tax Data.- Data necessary for fulfilling a contractual relationship, such as: banking institution and branch names, bank account number(s), certificates of tax status, proof of tax obligation compliance, proof of compliance with the National Housing Fund Institute for Workers (INFONAVIT) and the Mexican Social Security Institute (IMSS), employer registration.  

CLUB REAL RESORT will also request and process data that the “Law” considers sensitive, which are listed below and will henceforth be understood as included within the term “Personal Data”.  

Images for video surveillance purposes.

• CLUB REAL RESORT prioritizes security on its premises, which is why there is a video surveillance system to ensure the safety of the individuals who visit our facilities. This system will collect your personal image in equipment and servers operated under the strictest confidentiality. This data will be used solely for purposes related to maintaining the safety and well-being of all individuals.  

3.- PURPOSES OF PROCESSING YOUR DATA.

We use the personal data collected from you for the following purposes:  

a.- In the context of receiving individuals at the CLUB REAL RESORT facilities, the main purposes of processing personal data are:  

• To provide the necessary assistance during your visit to the CLUB REAL RESORT facilities.
• To verify your identity when registering at the CLUB REAL RESORT facilities.  

b.- In the context of contractual management with our Suppliers, the main purposes of processing personal data are:  

• To create and keep the database of our Suppliers updated.
• Manage the Supplier selection and contracting process.
• Comply with the legal requirements applicable to this process.
• Confirm the identity of the Supplier and/or his legal representative.
• Receive and pay invoices and/or receipts for fees.
• Contract services.
• Ensure compliance with legal provisions on the prevention and identification of operations involving illicit resources, anti-corruption measures, and other applicable regulations through the implementation of administrative and technical procedures established for these purposes.
• Tendering processes.
• Analysis and investigation of commercial, financial, quality, security and liability aspects of the products and services offered.
• Management, control, administration, and updating of personal data related to suppliers (individual entities and legal representatives or contacts designated by legal entities).
• Compliance with supplier-related tax, labor and social security obligations.
• Video surveillance to maintain the safety of the individuals who visit our facilities.  

The above purposes are necessary for the initiation or continuation of the legal relationship between you and CLUB REAL RESORT. We also inform you that the collected data will not be processed for purposes that are not strictly necessary.  

4.- TRANSFERS OF PERSONAL DATA.

The processed personal data may be transferred and handled by entities other than CLUB REAL RESORT. The recipients of such transfers are listed below:  

a). Parent companies, subsidiaries, or affiliates of CLUB REAL RESORT, for the purpose of safeguarding and consolidating information about our suppliers and visitors, managing our database by handling registration and removal of suppliers, and for conducting evaluations of contracted services.    

5.- CONSENT FOR THE TRANSFER OF DATA.

The data transfers referred to in the above subsection do not require your consent to be carried out, as provided by Article 37 of the Law.  

6.- ARCO RIGHTS (Access, Rectification, Cancellation or Opposition).

You, as owner of the Personal Data collected by CLUB REAL RESORT, have the right to request Access, Rectification, Cancellation or Opposition regarding any data you have provided to us. For further clarity, we provide the following definitions:  

Access.- The right you have to access your data and know which of them are being used in accordance with the purposes for which they were collected.  

Rectification.- The right you have to request correction or modification of your data if they are incorrect.  

Cancellation.- The right you have to request the deletion of your data from CLUB REAL RESORT’ database when you believe they are not being processed in accordance with this Privacy Notice or with the Law and its regulations. The cancellation request can apply to all your data or only some of it.  

Opposition.- The right you have to object to the processing of your Personal Data or to demand the cessation of its use.  

Exercising any of the aforementioned rights does not limit or exclude the possibility of exercising any of the others, nor is there a specific order of execution; therefore, the exercise of one right will not be a requirement for exercising the others. However, the Law establishes circumstances in which it will not be possible to comply with your request, particularly in the case of requests related to Opposition and/or Cancellation.  

You may submit your request to exercise your ARCO rights at any time and free of charge, either on your own behalf or through your legal representative. To do so, you must fill out the form called “ARCO Rights Request”. Download the ARCO Rights Request Form.

ARCO Rights requests may be submitted digitally via email sent to the address: datos@grupobd.mx  All requests must contain the following information:  

• Your name, address, and the means through which we can inform you of the response to your request.
• The documents that verify your identity and that of your legal representative (official ID’s, power of attorney).
• A detailed description of the Personal Data you wish to subject to any of the aforementioned rights.
• Any additional information that will help locate your Personal Data.
• In the case of a request for rectification of data, the modifications to be made and the document supporting your request.  

Within a maximum period of 20 (twenty) business days from the date you made your request, CLUB REAL RESORT will send you a response through the means you specified in your request. If applicable, the approved resolution will be implemented within a maximum of 15 (fifteen) days from the date CLUB REAL RESORT communicated the response to you.  

In the case of requests for access to your Personal Data, these will be considered as duly completed when CLUB REAL RESORT makes the requested information available to you by any means or format.  

ARCO Rights requests may be made by individuals other than yourself, provided that the designated person proves:  

• Your identity as the owner of the data that will be subject to the request.
• The identity of your legal representative.
• The existence of the legal representation, either through a public document, a power of attorney signed in the presence of two witnesses, or through your personal declaration.  

The request and delivery of the Personal Data will be free of charge; however, the requesting party will be required to cover the costs of shipping, certification, copies, or reproductions in other formats.  

As mentioned earlier, the Law establishes circumstances in which CLUB REAL RESORT may deny a request related to ARCO Rights. For more information on this, we suggest reviewing Article 34 (Thirty-Four) of the Federal Law on the Protection of Personal Data Held by Private Parties.  

For any questions regarding the processing of your Personal Data, contact the Personal Data Department of CLUB REAL RESORT via email at  datos@grupobd.mx or by calling (998) 272 8040 Ext. 5292 during business hours, Monday through Friday, from 9:00 a.m. to 1:00 p.m.

7.- METHODS AND PROCEDURES FOR THE DATA OWNER, IF APPLICABLE, TO REVOKE HIS CONSENT AT ANY TIME.

You may revoke your consent for the processing of your personal data without retroactive effects, in all cases where such revocation does not render it impossible to fulfill obligations arising from an existing legal relationship between you and CLUB REAL RESORT.

The procedure for revocation of consent, if applicable, will be the same as the one established in Section 6 of this Privacy Notice, regarding the exercise of ARCO rights.  

8.-USE OF COOKIES AND WEB BEACONS.

We hereby inform you that we do not collect personal data through the use of Cookies or Web Beacons and other technologies for obtaining personal information from you, such as the following:  

• Your type of browser and operating system.  
• The webpages you visit.  
• The links you follow.  
• The IP address.  
• The site you visited before entering ours.

9.- OPTIONS AND MEANS FOR LIMITING THE USE AND DISCLOSURE OF YOUR PERSONAL DATA.

You may limit the use or disclosure of your personal data by directing the request to our Personal Data Department. The requirements to verify your identity, as well as the procedure to address your request, will be the same as those outlined for the exercise of ARCO rights mentioned in Section 7 of this Privacy Notice.  

In order to help you limit the use and disclosure of your personal information, we offer the following option:  

Registration with the Public Registry to Avoid Advertising, managed by the Federal Consumer Protection Agency (PROFECO), so that your personal data is not used to receive advertising or promotions from goods or services companies. For more information about this registry, visit the PROFECO website or contact them directly.  

10.- SECURITY MEASURES IMPLEMENTED.

To protect your personal data, we have implemented administrative, physical, and technical security measures to prevent loss, misuse, or alteration of your information.  

When we communicate or share your information with third parties that provide us with services, we require and verify that they have the necessary security measures in place to protect your personal data, prohibiting the use of your personal information for purposes other than those established in this Privacy Notice. This is with the understanding that any non-compliance by such third parties with the provisions of the Law and its Regulations is the sole responsibility of those third parties.  

11.- MODIFICATIONS OF THE PRIVACY NOTICE.

We reserve the right to make modifications or updates to this Privacy Notice at any time.  

CLUB REAL RESORT will inform you of any changes made to this Privacy Notice, which will be available on the website: https://www.grupobd.mx/privacidad.

12.- COMPLAINTS AND GRIEVANCES.

If you believe that your right to personal data protection has been violated or if you suspect that there has been a breach in the processing of your personal data in violation of the provisions set forth in the Federal Law on Protection of Personal Data Held by Private Parties or its Regulations, you may file a complaint or report with the National Institute for Transparency, Access to Information, and Protection of Personal Data (INAI). For more information, visit the website: https://home.inai.org.mx/.