COMPREHENSIVE NOTICE OF PRIVACY FOR SUPPLIERS

In compliance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter referred to as the “Law”) and its Regulations, this Privacy Notice is issued under the following terms:  

1.- IDENTITY AND ADDRESS OF THE CONTROLLER.

Guc Hoteles, S.A. de C.V. (hereinafter referred to as “Atelier Playa Mujeres”), is a business corporation that has been duly incorporated under Mexican law, with address at Av. Bonampak, Supermanzana 10, Manzana 2, Lote 7, Cuarto Piso Torre “B”. Zip Code 77500, Cancun, Quintana Roo, Mexico. Atelier Playa Mujeres is responsible for the use and protection of your personal data, which will be processed based on the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility under the terms of the Law. To that end, we inform you as follows:  

2.- PERSONAL DATA TO BE COLLECTED AND SUBJECT TO PROCESSING.  

For the purposes outlined in this Privacy Notice, your data will be collected from the following sources: provided directly by you in person, via telephone, or through email. The personal data we obtain is as follows:  

The personal data we obtain from you directly and personally are those collected physically when you enter the premises of Atelier Playa Mujeres.  

The data we collect:  

• Identification and Contact Data.- Full name, age, gender, address and data on the proof of address, telephone numbers, company where you work, nationality, social security number, Population Registration ID (CURP) or its equivalent for foreign nationals, email, Federal Taxpayer Registry (RFC) or its equivalent for foreign nationals, handwritten signature, official identification with photograph, migration documents, academic data, names of family members, and any other document that is essential for identifying you. This may include fingerprints, video surveillance recordings, or any other method of control that is determined during your visit to our premises.
• ‍Legal information.- Legal powers granted to individuals who represent you or powers granted to you for representing individual and/or legal entities, including articles of incorporation for corporate entities, where applicable.
• ‍Financial, Asset-Related and Tax Data.- Data necessary for fulfilling a contractual relationship, such as: banking institution and branch names, bank account number(s), certificates of tax status, proof of tax obligation compliance, proof of compliance with the National Housing Fund Institute for Workers (INFONAVIT) and the Mexican Social Security Institute (IMSS), employer registration.  

3.- PURPOSES OF PROCESSING YOUR DATA.

We use the personal data collected from you for the following purposes:  

a.- In the context of receiving individuals at the Atelier Playa Mujeres facilities, the main purposes of processing personal data are:  

• To provide the necessary assistance during your visit to the Atelier Playa Mujeres facilities.
• To verify your identity when registering at the Atelier Playa Mujeres facilities.  

b.- In the context of contractual management with our Suppliers, the main purposes of processing personal data are:  

• To create and keep the database of our Suppliers updated.
• Manage the Supplier selection and contracting process.
• Comply with the legal requirements applicable to this process.
• Confirm the identity of the Supplier and/or his legal representative.
• Receive and pay invoices and/or receipts for fees.
• Contract services.
• Ensure compliance with legal provisions on the prevention and identification of operations involving illicit resources, anti-corruption measures, and other applicable regulations through the implementation of administrative and technical procedures established for these purposes.
• Tendering processes.
• Analysis and investigation of commercial, financial, quality, security and liability aspects of the products and services offered.
• Management, control, administration, and updating of personal data related to suppliers (individual entities and legal representatives or contacts designated by legal entities).
• Compliance with supplier-related tax, labor and social security obligations.  

The above purposes are necessary for the initiation or continuation of the legal relationship between you and Atelier Playa Mujeres. Additionally, we inform you that the collected data will not be processed for purposes that are not strictly necessary.  

4.- TRANSFERS OF PERSONAL DATA.

The processed personal data may be transferred and handled by entities other than Atelier Playa Mujeres. The recipients of such transfers are listed below:  

a). Parent companies, subsidiaries, or affiliates of Atelier Playa Mujeres, for the purpose of safeguarding and consolidating information about our suppliers and visitors, managing our database by handling registration and removal of suppliers, and for conducting evaluations of contracted services.  

5.- CONSENT FOR THE TRANSFER OF DATA.

The data transfers referred to in the above subsection do not require your consent to be carried out, as provided by Article 37 of the Law.  

6.- ARCO RIGHTS (Access, Rectification, Cancellation or Opposition).

You, as owner of the Personal Data collected by Atelier Playa Mujeres, have the right to request Access, Rectification, Cancellation or Opposition regarding any data you have provided to us. For further clarity, we provide the following definitions:  

Access.- The right you have to access your data and know which of them are being used in accordance with the purposes for which they were collected.  

Rectification.- The right you have to request correction or modification of your data if they are incorrect.  

Cancellation.- The right you have to request the deletion of your data from Atelier Playa Mujeres’ database when you believe they are not being processed in accordance with this Privacy Notice or with the Law and its regulations. The cancellation request can apply to all your data or only some of it.  

Opposition.- The right you have to object to the processing of your Personal Data or to demand the cessation of its use.  

Exercising any of the aforementioned rights does not limit or exclude the possibility of exercising any of the others, nor is there a specific order of execution; therefore, the exercise of one right will not be a requirement for exercising the others. However, the Law establishes circumstances in which it will not be possible to comply with your request, particularly in the case of requests related to Opposition and/or Cancellation.  

You may submit your request to exercise your ARCO rights at any time and free of charge, either on your own behalf or through your legal representative. To do so, you must fill out the form called “ARCO Rights Request”. Download the ARCO Rights Request Form.

ARCO Rights requests may be submitted digitally via email sent to the address: datos@grupobd.mx  All requests must contain the following information:  

• Your name, address, and the means through which we can inform you of the response to your request.
• The documents that verify your identity and that of your legal representative (official ID’s, power of attorney).
• A detailed description of the Personal Data you wish to subject to any of the aforementioned rights.
• Any additional information that will help locate your Personal Data.
• In the case of a request for rectification of data, the modifications to be made and the document supporting your request.  

Within a maximum period of 20 (twenty) business days from the date you made your request, Atelier Playa Mujeres will send you a response through the means you specified in your request. If applicable, the approved resolution will be implemented within a maximum of 15 (fifteen) days from the date Atelier Playa Mujeres communicated the response to you.  

In the case of requests for access to your Personal Data, these will be considered as duly completed when Atelier Playa Mujeres makes the requested information available to you by any means or format.  

ARCO Rights requests may be made by individuals other than yourself, provided that the designated person proves:  

• Your identity as the owner of the data that will be subject to the request.
• The identity of your legal representative.
• The existence of the legal representation, either through a public document, a power of attorney signed in the presence of two witnesses, or through your personal declaration.  

The request and delivery of the Personal Data will be free of charge; however, the requesting party will be required to cover the costs of shipping, certification, copies, or reproductions in other formats.  

As mentioned earlier, the Law establishes circumstances in which Atelier Playa Mujeres may deny a request related to ARCO Rights. For more information on this, we suggest reviewing Article 34 (Thirty-Four) of the Federal Law on the Protection of Personal Data Held by Private Parties.  

For any questions regarding the processing of your Personal Data, contact the Personal Data Department of Atelier Playa Mujeres via email at  datos@grupobd.mx or by calling (998) 272 8040 Ext. 5292 during business hours, Monday through Friday, from 9:00 a.m. to 1:00 p.m.

7.-USE OF COOKIES AND WEB BEACONS.

We inform you that we do not collect personal data through the use of Cookies or Web Beacons and other technologies for obtaining personal information from you, such as the following:  

• Your type of browser and operating system.  
• The webpages you visit.  
• The links you follow.  
• The IP address.  
• The site you visited before entering ours.

8.- METHODS AND PROCEDURES FOR THE DATA OWNER, IF APPLICABLE, TO REVOKE HIS CONSENT AT ANY TIME.

You may revoke your consent for the processing of your personal data, without retroactive effects, in all cases where such revocation does not render it impossible to fulfill obligations arising from an existing legal relationship between you and Atelier Playa Mujeres.

The procedure for revocation of consent, if applicable, will be the same as the one established in Section 6 of this Privacy Notice, regarding the exercise of ARCO rights.  

9.- OPTIONS AND METHODS FOR LIMITING THE USE AND DISCLOSURE OF YOUR PERSONAL DATA.

You may limit the use or disclosure of your personal data by directing the request to our Personal Data Department. The requirements to verify your identity, as well as the procedure to address your request, will be the same as those outlined for the exercise of ARCO rights mentioned in Section 7 of this Privacy Notice.  

In order to help you limit the use and disclosure of your personal information, we offer the following option:  

Registration with the Public Registry to Avoid Advertising, managed by the Federal Consumer Protection Agency (PROFECO), so that your personal data is not used to receive advertising or promotions from goods or services companies. For more information about this registry, you can visit the PROFECO website or contact them directly.

10.- SECURITY MEASURES IMPLEMENTED.

To protect your personal data, we have implemented administrative, physical, and technical security measures to prevent loss, misuse, or alteration of your information.  

When we communicate or share your information with third parties that provide us with services, we require and verify that they have the necessary security measures in place to protect your personal data, prohibiting the use of your personal information for purposes other than those established in this Privacy Notice. This is with the understanding that any non-compliance by such third parties with the provisions of the Law and its Regulations is the sole responsibility of those third parties.  

11.- MODIFICATIONS OF THE PRIVACY NOTICE.

We reserve the right to make modifications or updates to this Privacy Notice at any time.  

Atelier Playa Mujeres will inform you of any changes made to this Privacy Notice, which will be available through notices that are visible at the Hotel reception or on the website: https://www.grupobd.mx/privacidad

12.- COMPLAINTS AND GRIEVANCES.

If you believe that your right to personal data protection has been violated or if you suspect that there has been a breach in the processing of your personal data in violation of the provisions set forth in the Federal Law on Protection of Personal Data Held by Private Parties or its Regulations, you may file a complaint or report with the National Institute for Transparency, Access to Information, and Protection of Personal Data (INAI). For more information, visit the website: https://home.inai.org.mx/.