“PRIVACY NOTICE” ENTERED INTO BY, ON THE ONE HAND, Operadora Inmobiliaria Achar, S. de R.L. de C.V., Operadora Lamartine 619, S. de R.L. de C.V., Operadora Newton 119, S. de R.L. de C.V., and Operadora Campeche 428 (hereinafter collectively referred to as the “OPERATORS”); AND, ON THE OTHER HAND, ANY AND ALL INDIVIDUALS WHO ARE THE OWNERS OF THE INFORMATION CONTAINED IN THE PRINTED OR ELECTRONIC FORMS (“THE FORMS”) PROVIDED BY Operadora Inmobiliaria Achar, S. de R.L. de C.V., Operadora Lamartine 619, S. de R.L. de C.V., Operadora Newton 119, S. de R.L. de C.V., and Operadora Campeche 428, S. de R.L. de C.V. (the “OPERATORS”) (HEREINAFTER REFERRED TO AS THE “OWNER OF THE PERSONAL DATA”).
I. STATEMENTS:
(a) Each of the OPERATORS declares:
(i) To be a company duly incorporated under the laws of the United Mexican States;
(ii) To have its registered address at Río Atoyac 89, Cuauhtémoc, 06500 Mexico City, Mexico; Lamartine 619, Polanco, Polanco V Section, 11550 Mexico City, Mexico; Av. Isaac Newton 119, Polanco, Polanco V Section, 11570 Mexico City, Mexico; Av. Cicerón 612, Polanco, Polanco II Section, 11560 Polanco, Mexico City, Mexico; respectively.
(b) The Owner of the Personal Data declares under oath that:
(i) All data entered in the FORMS is true and accurate;
(ii) They have received satisfactory information regarding the contents of this Privacy Notice and fully understand and expressly accept its terms and conditions, as well as the manner in which the OPERATORS protect the personal data provided to them;
(iii) They have sufficient legal capacity to be bound by the terms and conditions of this Privacy Notice.
II. PURPOSE AND SCOPE:
The purpose of this Privacy Notice is to establish the terms and conditions under which the OPERATORS protect the personal data provided by their clients, tenants, and guests, in order to safeguard their privacy and right to informational self-determination, pursuant to the Federal Law on the Protection of Personal Data Held by Private Parties (“LFPDPPP”) and the administrative regulations derived therefrom or related thereto, regardless of the means or method by which the personal data is collected and/or processed.
This Privacy Notice allows the OPERATORS to comply with their contractual obligations, as well as those arising from legislation and administrative regulations regarding personal data protection, commercial matters, and tax matters.
III.
The OPERATORS undertake to observe the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and accountability in the processing of personal data; they collect and process personal data lawfully, without employing fraudulent or deceptive means. The processing of personal data shall be limited to the fulfillment of the purposes set forth in this Privacy Notice.
In the case of sensitive personal data, the OPERATORS shall establish the necessary measures to limit the processing period to the minimum indispensable.
The OPERATORS undertake to cancel the personal data provided by you once it is no longer necessary for the fulfillment of the purposes set forth in this Privacy Notice. The foregoing shall be without prejudice to retaining the information and documentation required to comply with obligations established in the Commercial Code (Código de Comercio), the Federal Fiscal Code (Código Fiscal de la Federación), and other tax legislation, as well as any other applicable present or future legislation.
(h) PRINCIPLE OF ACCOUNTABILITY:
For the purpose of complying with this Privacy Notice, the LFPDPPP, and the administrative regulations derived therefrom, the OPERATORS have established the Personal Data Department of the company, which, among other functions, processes requests submitted by you to exercise your rights under the LFPDPPP and responds to requests from the IFAI and other competent authorities.
IV. INFORMATION AND DOCUMENTATION COLLECTED AND PROCESSED:
The OPERATORS collect and process your personal data, that is, information that may reasonably identify you and which may appear in various documents.
The personal data collected and processed may include: first and last name; home, work, or tax address; email address; landline and/or mobile phone number; credit card number and security code; Federal Taxpayers Registry (Registro Federal de Contribuyentes – RFC) number.
The OPERATORS also collect personal data from publicly accessible sources and other market sources to which you may have consented to share your personal information.
V. PURPOSES OF THE INFORMATION:
The personal data described in Section IV above is collected and processed for the following purposes:
(1) To manage information relating to our guests, clients, and prospects in order to maintain an updated database;
(2) To manage relationships with clients and prospects by providing information regarding contracted services and activities or those in the process of being contracted;
(3) To carry out commercial and service management for clients and guests;
(4) To manage the commercialization of services based on reservation confirmation documents and receipt of deposits on account;
(5) To document and guarantee confirmed reservations under the agreed conditions;
(6) To enter into agreements with the client;
(7) To provide clear and visible information to clients and guests regarding conditions, policies, and provisions for contracting and using services and facilities, as well as environmental practices, payment methods, service rates, modalities, schedules, and any changes occurring after reservation confirmation or any unusual circumstances at the establishment, such as construction work, schedule limitations, or service restrictions, among others;
(8) To manage food services, room service, housekeeping and room maintenance, telephone assistance, parking services, among others, based on previously defined and communicated policies;
(9) To manage parcel and courier services for package deliveries and shipments on behalf of clients or guests;
(10) To manage currency exchange services on behalf and by order of exchange houses;
(11) To manage charges and collections from clients and guests via bank cards, credit, and cash;
(12) To prepare, manage, send, and collect invoices or digital tax receipts;
(13) To manage credit granted to clients and guests for payment of services;
(14) To prepare and manage commercial documents for clients and guests in printed or electronic format;
(15) To manage incentives for clients and guests;
(16) To prepare internal statistics indicating the services and products most appreciated by clients, tenants, guests, and other users of hotel or residential services;
(17) To manage guest and client check-in and check-out based on previously defined and communicated policies;
(18) To monitor and control physical and logical access to hotel facilities and assets;
(19) To control visitor access;
(20) To manage security by applying the applicable legal regulations regarding safety, hygiene, contingency plans, evacuation, and emergencies;
(21) To safeguard valuable items belonging to guests and clients;
(22) To safeguard, destroy, send, or deliver, as applicable, objects, documents, and payment instruments forgotten by clients or guests;
(23) To process and respond to complaints or claims submitted by guests and clients through the means made available for such purposes;
(24) To manage legal actions aimed at resolving disputes arising between clients and/or guests and the hotel;
(25) To manage payment of compensation agreed upon with insurance companies on behalf of clients or guests;
(26) To manage client satisfaction through surveys and understanding their needs and preferences, as well as other analogous purposes described above.
Likewise, the OPERATORS shall install video surveillance cameras within their facilities for security purposes. Recordings are stored in a secure area with restricted access to managers, executives, and, where applicable, competent authorities. Recordings are routinely destroyed unless required for the investigation of an incident or for judicial proceedings.
VI. TRANSFER OF PERSONAL DATA TO THIRD PARTIES:
The OPERATORS shall not commercialize your personal data with third parties.
In order to provide services and carry out the processes described in Section V above, the OPERATORS have entered into various commercial agreements with product and service providers, both domestically and internationally, who are obligated under the corresponding agreements to maintain the confidentiality of the personal data supplied by the OPERATORS and to comply with this Privacy Notice.
Accordingly, such providers may not use the personal data supplied by the OPERATORS for any purpose other than providing the services contracted by the OPERATORS.
VII. RETENTION AND SECURITY OF PERSONAL DATA:
The OPERATORS retain your personal data for as long as necessary to process your requests for information and/or services, as well as to maintain accounting, financial, and audit records in accordance with current commercial, tax, and administrative legislation.
The personal data collected by the OPERATORS is protected through appropriate administrative, technical, and physical security measures against damage, loss, alteration, destruction, or unauthorized use, access, or processing, in accordance with the LFPDPPP and the administrative regulations derived therefrom.
All personal data stored electronically is maintained in confidential and secure databases.
The OPERATORS regularly evaluate their security equipment and procedures and modify them whenever necessary.
To prevent unauthorized access or improper disclosure of personal data, and in order to maintain accuracy, integrity, availability, and confidentiality, the OPERATORS also use appropriate legal procedures and controls in accordance with the LFPDPPP and the administrative regulations derived from the Law.
When processing financial personal data, such as information related to your bank account, the OPERATORS use various technologies and procedures designed to protect your personal data, including secret usernames and passwords, encryption tools (PGP) for laptop computers, and FTPS data transfers.
Such personal data is stored in computer systems protected by antivirus, spyware, and other malicious code prevention software; additionally, protected networks with firewalls and controlled-access facilities are used.
VIII. PERSONAL DATA DEPARTMENT:
The OPERATORS provide the email address below for the purpose of receiving, registering, and processing requests to exercise your rights of access, rectification, cancellation, and opposition regarding the processing of your personal data, as well as to limit the use or disclosure thereof, and any other rights provided under the LFPDPPP.
For any request, clarification, or comment related to this Privacy Notice, please contact:
The OPERATORS, via email at:
departamento.comercial@imatsc.com
IX. ARCO RIGHTS:
You have the right to have your personal data corrected when it is inaccurate or incomplete.
You have the right to request at any time that your personal data be deleted, which shall occur once the blocking period has elapsed. During such period, your personal data shall not be processed, and once the period concludes, it shall be canceled from the corresponding database.
You also have the right at any time, provided there is a legitimate reason, to request that the OPERATORS cease processing your personal data.
Procedure for Exercising ARCO Rights:
To exercise ARCO rights, you or your representative must submit a request for access, rectification, cancellation, or opposition containing the following information and documentation:
(i) The name of the data owner and address or other means to communicate the response to the request;
(ii) Documents proving identity (simple printed or electronic copy of voter ID card, passport, or FM-3) or, where applicable, legal representation of the data owner (simple printed or electronic copy of a power of attorney signed by the owner, two witnesses, and the attorney-in-fact, together with their corresponding official identifications – voter ID card, passport, or FM-3);
(iii) A clear and precise description of the personal data with respect to which any of the ARCO rights are to be exercised; and
(iv) Any other element or document facilitating the location of the personal data.
In the case of requests for rectification of personal data, you must also indicate the modifications to be made and provide documentation supporting your request.
The OPERATORS shall respond within a maximum period of twenty days from the date the request for access, rectification, cancellation, or opposition was received, communicating the determination adopted so that, if appropriate, it becomes effective within fifteen days following the date the response is communicated.
In the case of requests for access to personal data, the OPERATORS shall provide such data upon verification of the identity of the applicant or their legal representative, as applicable.
The aforementioned periods may be extended once for an equal period when justified by the circumstances of the case.
Delivery of personal data shall be free of charge; however, you shall be responsible for justified shipping costs or reproduction costs in copies or other formats.
If you repeat your request within a period shorter than twelve months, you must cover the corresponding costs pursuant to the LFPDPPP, unless substantial modifications have been made to the Privacy Notice that justify new consultations.
X. CHANGES TO THE PRIVACY NOTICE:
The OPERATORS may modify this Privacy Notice at any time in order to implement improvements or incorporate new measures provided by law or other regulatory provisions. Therefore, you are advised to review its content regularly.
Updates shall be published on the website.
XI. CONSENT:
You provide your express consent for the collection, processing, and use of your personal data in accordance with this Privacy Notice by expressing your will through a written or electronic statement, through any other technology, or by voluntarily providing the requested information.
You provide your tacit consent to this Notice by not objecting to its content within 48 hours following its publication on the website.
In some cases, the LFPDPPP allows the OPERATORS to collect, use, and disclose your personal data without your consent.
If the OPERATORS obtain personal information through third parties, they shall require such third parties to confirm that they have the corresponding consent for the disclosure of your personal data.
If you request that the OPERATORS revoke your consent, the OPERATORS shall take the necessary measures to destroy or eliminate the personal data you have provided, subject to the exceptions provided by the LFPDPPP.
Residual personal information may remain in archived or historical records. Furthermore, the OPERATORS may not destroy tax or accounting information related to transactions that may be necessary to comply with legal obligations.
However, the OPERATORS shall not use your personal information for any other purposes once you revoke your consent.
XII. APPLICABLE LEGISLATION:
The interpretation and application of this Privacy Notice shall be governed by the Federal Law on the Protection of Personal Data Held by Private Parties, the Federal Civil Code, and all other applicable laws and regulatory and administrative provisions.
XIII. EFFECTIVE DATE:
This Privacy Notice shall become effective as of its publication date, except for Section IX. ARCO Rights, which shall become effective on January 6, 2012, as provided in the Third and Fourth Transitory Articles of the LFPDPPP.
XIV. CONSENT DECLARATION:
THE OWNER OF THE PERSONAL DATA expressly declares having read the contents of this Privacy Notice and having no objection thereto.
