COMPREHENSIVE NOTICE OF PRIVACY FOR EMPLOYEES

In compliance with Articles 15, 16, and other applicable provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter referred to as the “Law”) and its Regulations, this Privacy Notice is made available to interested parties.  

1.- IDENTITY AND ADDRESS OF THE CONTROLLER.

Guc Hoteles, S.A. de C.V. (hereinafter referred to as “Atelier Playa Mujeres”) is a company that has been duly incorporated in accordance with Mexican law, a member of Grupo BD, with its address at Avenida Bonampak, Supermanzana 10, Manzana 2, Lote 7, Torre "B” fourth floor, Zip Code 77500, in the city of Cancun, Quintana Roo, Mexico. Atelier Playa Mujeres is responsible for processing the personal data that you provide us, which will be protected according to the provisions of the Law, its Regulations and the Notice of Privacy Guidelines.

2.- PERSONAL DATA TO BE COLLECTED AND SUBJECT TO PROCESSING.

Based on the legal relationship that you have established with Atelier Playa Mujeres, the company may collect and process the following data:

• Identification and contact data: Full name, gender, email, address and information in proofs of address, private landline and mobile phone numbers, marital status, place and date of birth, nationality, age, languages you speak, Federal Taxpayer Registry (RFC) data, Population Registration ID (CURP), handwritten signature, photographs, images, the information contained on the voter’s card, passport, social security number, the data contained on certificates issued by the Civil Registry Office of the holder and his beneficiaries (birth, adoption, marriage, and death certificates), names of family members, dependents and beneficiaries.

• Academic and work-related data: Employee number, type of personnel, assigned position or appointment, job level in the organizational structure, date of entry into the position, educational background, titles, professional license number, diplomas, certificates of study, curriculum vitae, work history, information related to previous jobs.  

• Identification and third-party contact data: Full name, landline and mobile phone number, email, relationship to you, contact details of individuals who can provide personal and/or work references, and individuals to be contacted in case of emergency, as well as your spouse, partner, parents and children, as applicable.

• Financial and asset-related data: Current and previous salary, other earnings and/or income, deductions, information related to tax obligations, bank account details such as account number and type, bank card number, CLABE account number, economic activity and tax regime in the Federal Taxpayer Registry (RFC) forms, Retirement Fund Administrator (AFORE) you belong to, information about your housing subaccount with the National Housing Fund Institute for Workers (INFONAVIT), National Fund for Worker’s Consumer Spending (FONACOT) information, insurance policies, results of socioeconomic studies conducted.

Atelier Playa Mujeres may also request and process data that the Law considers sensitive, which is listed below and will henceforth be understood as included under the term “Personal Data”.

• Ideological data: union affiliation, affiliation with social organizations.

• Health data: Clinical history, blood type, allergies, psychological or psychiatric profile, medical disabilities, current or future health condition, and any other information that may help establish a clear profile of your health condition.

• Physical and personal characteristics: Fingerprints, height, weight (used to uniquely identify an individual).

• Images for video surveillance purposes. Atelier Playa Mujeres prioritizes security on its premises, which is why there is a video surveillance system to ensure the safety of employees, clients, and individuals who visit our facilities. This system will collect your personal image through equipment and servers operated under the strictest confidentiality. This data will be used solely for purposes related to maintaining the safety and well-being of all individuals.

Atelier Playa Mujeres may request at any time, that you show or provide original documents or copies thereof in order to verify the information previously provided.

3.- PURPOSES OF THE PROCESSING OF COLLECTED DATA.

This document is intended to define the scope and general conditions of use and processing that Atelier Playa Mujeres will carry out regarding your Personal Data. The collection, use, handling, utilization, storage, disclosure, and/or transfer of your data aims to fulfill the necessary purposes outlined below:

• To conduct an analysis of your application for the position or job you applied for, as well as to evaluate your work skills and, if applicable, to formalize the employment relationship and identify you as an employee.
• Verify your identity, location, request references and to generally verify that the information you have provided is authentic.
• Carry out administrative procedures related to your hiring.
• Fulfill job profile requirements.
• Pay remunerations and benefits.
• If applicable, assign and verify travel allowances and tickets for national and international trips.
• Prepare accounting entries with supporting documentation for expenses.
• Provide insurance coverage and assign beneficiaries for the insurance.
• Monitor attendance.
• Provide social security, economic and healthcare benefits.
• Procedures related to FONACOT loans.
• Provide induction courses, training and/or coaching.
• Create a physical or digital file with your hiring data.
• Carry out affiliation procedures with the Mexican Social Security Institute (IMSS), the National Housing Fund Institute for Workers (INFONAVIT), the Tax Administration Service (SAT), banking institutions, and similar organizations where affiliation is necessary for the employment relationship.
• Grant labor benefits.
• Provide access and permissions to work on the premises and assign work tools.
• If applicable, arrange business trips or work assignments, whether within the same municipality, state, country, or abroad.
• Ensure the security of the workplace facilities and protect the property and rights of Atelier Playa Mujeres, its parent companies, affiliates and/or subsidiaries, employees, clients, and suppliers, as well as the confidentiality of the information related to the aforementioned individuals.
• Conduct analyses, reviews or evaluations of your behavior and/or performance within the workplace facilities, aimed at ensuring compliance with policies, manuals, codes of ethics and conduct, internal regulations, and other internal work guidelines. For these purposes, we may periodically and randomly review the information contained in the computers and other devices provided to you as work tools, including use of the internet.
• If applicable, to collaborate with authorities in investigations concerning violations or breaches of laws.
• If necessary, contact the persons you have designated in emergency situations.
• Video surveillance for the safety of the individuals visiting our facilities.

Additionally, Atelier Playa Mujeres may use your information for the following non-essential purposes:

• To provide objective references to third parties regarding your job performance, even after the legal relationship between Atelier Playa Mujeres and you has ended, as permitted by applicable laws. This consent will be considered valid even after the legal relationship with Atelier Playa Mujeres has concluded, unless you explicitly express your refusal of this processing.
• For application of surveys and evaluations.
• To promote and improve the workplace environment and climate (such as dissemination of congratulations for achievements, birthdays, and other special celebrations).

If you do not wish for your personal data to be used for these additional purposes, you can deny your consent by sending an email to the following address: datos@grupobd.mx.

Your refusal to use your personal data for these purposes cannot be a reason for us to prevent you from performing the activity for which you were hired.

4.- TRANSFER OF PERSONAL DATA.

You are hereby informed that, in accordance with Article 37 (Thirty-Seven) of the Law, there are certain circumstances under which we may transfer your personal data nationally or internationally without your authorization being necessary. Such circumstances include transfers made to parent companies, subsidiaries, or affiliates that belong to the same corporate group as Atelier Playa Mujeres, and those transfers that are necessary for maintaining or fulfilling the legal/employment relationship between you and Atelier Playa Mujeres.

The following are companies or entities other than Atelier Playa Mujeres to which we may transfer your Personal Data:

‍

Atelier Playa Mujeres informs you that it does not make transfers that are not in accordance with the provisions of Article 37 (Thirty-Seven) of the Law. In the eventuality that Atelier Playa Mujeres decides to change this policy, you will be duly informed through the means and procedures outlined hereinafter, and you will be provided with the necessary tools to authorize or prohibit transfers that are not deemed essential.

5.- ARCO RIGHTS, MEANING AND PROCEDURE FOR EXERCISING THEM.

You, as the owner of the Personal Data collected by Atelier Playa Mujeres, have the right to request Access, Rectification, Cancellation, or Opposition regarding any data you have provided to us. For further clarity, below we provide the following definitions:

Access.- The right you have to access your data and know which of them are being used in accordance with the purposes for which they were collected.

Rectification.- The right you have to request correction or modification of your data if they are incorrect.

Cancellation.- The right you have to request the deletion of your data from Atelier Playa Mujeres’ database when you believe they are not being processed in accordance with this Privacy Notice or with the Law and its regulations. The cancellation request can apply to all your data or only some of it.

Opposition.- The right you have to object to the processing of your Personal Data or to demand the cessation of its use.

Exercising any of the aforementioned rights does not limit or exclude the possibility of exercising any of the others, nor is there a specific order of execution; therefore, the exercise of one right will not be a requirement for exercising the others. However, the Law establishes circumstances in which it will not be possible to comply with your request, particularly in the case of requests related to Opposition and/or Cancellation.

You may submit your request to exercise your ARCO rights at any time and free of charge, either on your own behalf or through your legal representative. To do so, you must fill out the form titled "ARCO Rights Request". Download the ARCO Rights Request Form. You may also request the hard copy directly in Human Talent and Sustainability.

ARCO Rights requests may be submitted digitally via email sent to the address datos@grupobd.mx, They may also be submitted physically to the Human Talent and Sustainability Department, who will send the request to the Personal Data Department. In both cases, all requests must contain the following information:

• Your name, address, and the method through which we can inform you of the response to your request.
• Documents that verify your identity or that of your legal representative (official ID’s, power of attorney).
• A detailed description of the Personal Data you wish to subject to any of the aforementioned rights.
• Additional information that will help locate your Personal Data.
• In the case of a request for rectification, the modifications to be made and the documentation supporting your request.

Within a maximum period of 20 (twenty) business days from the date you made your request, Atelier Playa Mujeres will send you a response through the means you specified in your request. If applicable, the approved resolution will be implemented within a maximum of 15 (fifteen) days from the date Atelier Playa Mujeres communicated the response to you.

In the case of requests for access to your Personal Data, these will be considered as duly completed when Atelier Playa Mujeres makes the requested information available to you, through any means or format.

ARCO Rights requests may be made by individuals other than yourself, provided that the designated person proves:

• Your identity as the owner of the data that will be subject to the request.
• The identity of your legal representative.
• The existence of the representation, either through a public document, a power of attorney signed in the presence of two witnesses, or through your personal declaration.

The request and delivery of Personal Data will be free of charge; however, the requesting party will be required to cover the costs of shipping, certification, copies, or reproductions in other formats.

As mentioned earlier, the Law establishes circumstances in which Atelier Playa Mujeres may deny a request related to ARCO Rights. For more information on this, we suggest reviewing Article 34 (Thirty-Four) of the Federal Law on the Protection of Personal Data Held by Private Parties.

For any questions regarding the processing of your Personal Data, contact the Personal Data Department of Atelier Playa Mujeres via email at datos@grupobd.mx or by phone at (998) 272 8040 ext. 5292 during business hours, Monday through Friday, from 9:00 a.m. to 1:00 p.m.

6.- REVOCATION OF CONSENT FOR THE PROCESSING OF YOUR DATA.

You may, at any time, revoke the consent you have granted to Atelier Playa Mujeres for the processing of your Personal Data; however, you should be aware that revocation of consent for processing represents the definitive cessation of the use of information and it would mean a termination of the employment relationship between you and Atelier Playa Mujeres.

You may personally submit your revocation request via email to datos@grupobd.mx, in which you should include your name, attach a copy of your official identification, and specify the method through which we can inform you of the response to your request. You may also request this through your legal representative, provided the designated person meets the requirements specified for ARCO Rights requests.

The deadlines, hours, and response mechanisms will be the same as those established for ARCO Rights requests.

7. USE OF COOKIES AND WEB BEACONS.

We inform you that we do not collect personal data through the use of Cookies or Web Beacons and other technologies to obtain personal information from you, such as the following:

• Your type of browser and operating system.
• The webpages you visit.
• The links you follow.
• The IP address.
• The site you visited before entering ours.

8.- MEANS FOR LIMITING THE USE OR DISCLOSURE OF YOUR PERSONAL DATA.

Atelier Playa Mujeres will not use or disclose your personal data for purposes other than those strictly necessary for fulfilling the employment relationship between you and Atelier Playa Mujeres, always in accordance with the guidelines described in this Privacy Notice. Consequently, you will receive essential documentation for maintaining the employment relationship, such as your pay slips.

Atelier Playa Mujeres will not send you, either directly or through third parties, information or documentation for marketing, advertising, or commercial prospecting purposes. However, if you believe Atelier Playa Mujeres is using or disclosing your Personal Data for purposes other than those described in this document, you may exercise any of the ARCO Rights of which you have previously been informed. Additionally, as general information, you are hereby informed that you have the following options to restrict the sending of unauthorized advertising:

• Registration with the Public Registry to Avoid Publicity (REPEP), a registry managed by the Federal Consumer Protection Agency, aimed at ensuring that users’ data is not used for marketing or advertising purposes through phone calls and text messages.
• Registration with the Public Registry of Users, a registry that contains information about Users of the Mexican Financial System who do not wish to be bothered by advertising promotions from financial institutions.

9.- CHANGES TO THE PRIVACY NOTICE.

This Notice of Privacy may be subject to modifications, changes, or updates as necessary to remain in accordance with legal provisions regarding Personal Data. If applicable, Atelier Playa Mujeres will inform you of any changes by publishing them on the website https://www.grupobd.mx/privacidad.

10.- CONSENT.

By signing at the bottom of this document, you are acknowledging that you have read the content of this Privacy Notice, are aware of the legal implications as well as your rights regarding Personal Data, and that you expressly consent to the processing of your Personal Data, including data considered sensitive. You also consent to transfers of your Personal Data to third parties under the terms stated in this Privacy Notice.

11.-COMPLAINTS AND GRIEVANCES.

If you believe that your right to personal data protection has been violated, or suspect that there has been a breach in the processing of your personal data in violation of the provisions set forth in the Federal Law on the Protection of Personal Data Held by Private Parties or its Regulations, you may file the corresponding complaint or report with the National Institute for Transparency, Access to Information, and Protection of Personal Data (INAI). For more information, please visit the website: https://home.inai.org.mx/

‍