“PRIVACY NOTICE” ENTERED INTO BY, ON THE ONE HAND, Operadora Inmobiliaria Achar, S. de R.L. de C.V., Operadora Lamartine 619, S. de R.L. de C.V., Operadora Newton 119, S. de R.L. de C.V., and Operadora Campeche 428 (hereinafter collectively referred to as the “OPERATORS”), AND, ON THE OTHER HAND, ANY AND ALL INDIVIDUALS WHO ARE HOLDERS OF THE INFORMATION CONTAINED IN THE PRINTED OR ELECTRONIC FORMS (“THE FORMS”) PROVIDED BY Operadora Inmobiliaria Achar, S. de R.L. de C.V., Operadora Lamartine 619, S. de R.L. de C.V., Operadora Newton 119, S. de R.L. de C.V., and Operadora Campeche 428, S. de R.L. de C.V. (the “OPERATORS”) (hereinafter referred to as the “DATA SUBJECT”).
I. STATEMENTS:
(a) Each of the OPERATORS represents that:
(i) It is a company duly incorporated under the laws of the United Mexican States;
(ii) Its registered address is located at Río Atoyac 89, Cuauhtémoc, 06500 Mexico City, Mexico; Lamartine 619, Polanco, Polanco V Secc, 11550 Mexico City, Mexico; Av. Isaac Newton 119, Polanco, Polanco V Secc, 11570 Mexico City, Mexico; and Av. Cicerón 612, Polanco, Polanco II Secc, 11560 Polanco, Mexico City, Mexico; respectively.
(b) The Data Subject declares, under oath, that:
(i) All information entered in the FORMS is true and accurate;
(ii) The Data Subject has received satisfactory information regarding the contents of this Privacy Notice and fully understands and expressly accepts its terms and conditions and the manner in which the OPERATORS protect the personal data provided to them;
(iii) The Data Subject has the legal capacity necessary to be bound by the terms and conditions of this Privacy Notice.
II. PURPOSE AND SCOPE:
The purpose of this Privacy Notice is to establish the terms and conditions under which the OPERATORS protect the personal data provided by their clients, tenants, and guests in order to safeguard their privacy and right to informational self-determination, pursuant to the Federal Law on the Protection of Personal Data Held by Private Parties (“LFPDPPP”) and its applicable regulations, regardless of the means or manner in which such personal data is collected and/or processed.
This Privacy Notice enables the OPERATORS to comply with their contractual obligations, as well as obligations arising from applicable laws and regulations concerning personal data protection, commercial matters, and tax matters.
III.
The OPERATORS undertake to observe the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and accountability in the processing of personal data. They collect and process personal data lawfully and without the use of fraudulent or deceptive means; the processing of personal data is limited to fulfilling the purposes set forth in this Privacy Notice.
With respect to sensitive personal data, the OPERATORS shall implement the necessary measures to limit the processing period to the minimum indispensable term.
The OPERATORS undertake to delete the personal data provided by you once it is no longer necessary for the fulfillment of the purposes set forth in this Privacy Notice. Notwithstanding the foregoing, the OPERATORS may retain information and documentation required to comply with obligations established under the Commercial Code, the Federal Tax Code, and other applicable present or future tax legislation, as well as any other applicable legislation.
(h) ACCOUNTABILITY PRINCIPLE:
For purposes of compliance with this Privacy Notice, the LFPDPPP, and the regulations derived therefrom, the OPERATORS have established a Personal Data Department, which is responsible, among other functions, for processing requests submitted by you to exercise your rights under the LFPDPPP, as well as responding to requests from the IFAI and other competent authorities.
IV. INFORMATION AND DOCUMENTATION COLLECTED AND PROCESSED:
The OPERATORS collect and process your personal data, meaning information that may reasonably identify you and which may be contained in various documents.
The personal data collected and processed may include: first and last name; home, business, or tax address; email address; landline and/or mobile telephone number; credit card number and security code; and Federal Taxpayer Registry number (RFC).
The OPERATORS also collect personal data from publicly accessible sources and other sources available in the market to which you may have given consent to share your personal information.
V. PURPOSES OF THE INFORMATION:
The personal data described in Section IV above are collected and processed for the following purposes:
(1) To manage information relating to our guests, clients, and prospects and maintain an updated database;
(2) To manage relationships with clients and prospects by providing information regarding contracted or prospective services and activities;
(3) To carry out commercial and customer service management for clients and guests;
(4) To manage the marketing of services based on reservation confirmations and receipt of deposits on account;
(5) To document and guarantee confirmed reservations under agreed conditions;
(6) To execute agreements with clients;
(7) To provide clients and guests with clear and visible information regarding terms, policies, and provisions governing the contracting and use of services and facilities, as well as environmental practices, payment methods, service rates, schedules, modalities, and any changes to reservations after confirmation or any unusual circumstances at the establishment, including construction work or service limitations;
(8) To manage food services, room service, housekeeping and maintenance, telephone assistance, parking services, and related services based on previously established and communicated policies;
(9) To manage courier and package delivery services on behalf of clients or guests;
(10) To manage currency exchange services through authorized exchange houses;
(11) To process charges and collections from clients and guests through bank cards, credit, or cash payments;
(12) To prepare, manage, send, and collect invoices or digital tax receipts;
(13) To manage credit granted to clients and guests for payment of services;
(14) To prepare and manage commercial documents for clients and guests in printed or electronic format;
(15) To manage incentives for clients and guests;
(16) To prepare internal statistics indicating the services and products most appreciated by clients, tenants, guests, and other users of the hotel or residential services;
(17) To manage guest and client check-in and check-out processes based on previously established and communicated policies;
(18) To monitor and control physical and logical access to hotel facilities and assets;
(19) To control visitor access;
(20) To manage security by applying current legal regulations concerning safety, hygiene, contingencies, evacuation plans, and emergencies;
(21) To safeguard valuables belonging to guests and clients;
(22) To safeguard, destroy, send, or return, as applicable, objects, documents, and payment instruments forgotten by clients or guests;
(23) To process and respond to complaints or claims submitted by guests and clients through the means provided for such purposes;
(24) To manage legal acts aimed at resolving disputes arising between clients and/or guests and the hotel;
(25) To process payment of indemnities agreed upon with insurance companies on behalf of clients or guests;
(26) To manage customer satisfaction through surveys and understanding clients’ needs and preferences, as well as other analogous purposes.
Likewise, the OPERATORS shall implement video surveillance cameras within their facilities for security purposes. Recordings shall be stored in a secure area with restricted access limited to managers, executives, and, where applicable, competent authorities. Recordings are routinely destroyed unless required for the investigation of an incident or legal proceeding.
VI. TRANSFER OF PERSONAL DATA TO THIRD PARTIES:
The OPERATORS shall not commercialize your personal data with third parties.
In order to provide services and carry out the processes described in Section V above, the OPERATORS have entered into various commercial agreements with product and service providers both domestically and abroad. Such providers are contractually obligated to maintain the confidentiality of the personal data supplied by the OPERATORS and to observe this Privacy Notice.
Accordingly, such providers may not use the personal data supplied by the OPERATORS for any purpose other than providing the contracted services.
VII. RETENTION AND SECURITY OF PERSONAL DATA:
The OPERATORS retain your personal data for as long as necessary to process your requests for information and/or services, as well as to maintain accounting, financial, and audit records pursuant to applicable commercial, tax, and administrative legislation.
The personal data collected by the OPERATORS are protected by appropriate administrative, technical, and physical security measures against damage, loss, alteration, destruction, unauthorized use, access, or processing, in accordance with the LFPDPPP and its regulations.
All personal data stored electronically are maintained in confidential and secure databases.
The OPERATORS regularly evaluate their security systems and procedures and modify them when necessary.
To prevent unauthorized access or improper disclosure of personal data and to maintain their accuracy, integrity, availability, and confidentiality, the OPERATORS also implement relevant legal procedures and controls in accordance with the LFPDPPP and its regulations.
When processing financial personal data, such as bank account information, the OPERATORS use various technologies and procedures designed to protect personal data, including secret usernames and passwords, encryption software (PGP) for portable computers, and FTPS data transfer protocols.
Such personal data are stored in computer systems protected by antivirus, anti-spyware, and other anti-malicious code software. Additionally, the OPERATORS use firewall-protected networks and controlled-access facilities.
VIII. PERSONAL DATA DEPARTMENT:
The OPERATORS make available the email address listed below for the receipt, registration, and processing of requests to exercise rights of access, rectification, cancellation, and objection regarding personal data, as well as to limit the use or disclosure thereof and exercise any other rights provided under the LFPDPPP.
For any request, clarification, or comment related to this Privacy Notice, please contact:
The OPERATORS, via email at: departamento.comercial@imatsc.com
IX. ARCO RIGHTS:
You have the right to have your personal data corrected when they are inaccurate or incomplete.
You have the right to request at any time that your personal data be deleted, which shall occur once the blocking period has elapsed. During such period, your personal data shall not be processed, and upon expiration thereof, the data shall be cancelled from the corresponding database.
You also have the right at any time, provided there is a legitimate cause, to request that the OPERATORS cease processing your personal data.
Procedure for Exercising ARCO Rights:
To exercise ARCO rights, you or your legal representative must submit a request for access, rectification, cancellation, or objection including the following information and documentation:
(i) The name of the data subject and address or other means to communicate the response;
(ii) Documents evidencing identity (simple printed or electronic copy of voter ID card, passport, or FM-3) or, where applicable, legal representation (simple printed or electronic copy of a power of attorney signed by the data subject, two witnesses, and the representative, together with their corresponding official identifications);
(iii) A clear and precise description of the personal data with respect to which any ARCO right is to be exercised; and
(iv) Any other element or document facilitating the location of the personal data.
In the case of requests for rectification of personal data, the applicant must also indicate the modifications to be made and provide supporting documentation.
The OPERATORS shall respond within a maximum term of twenty days from the date the request is received, informing the applicant of the determination adopted so that, if appropriate, the same may become effective within fifteen days following notification of the response.
In the case of requests for access to personal data, the OPERATORS shall provide the requested information upon verification of the identity of the applicant or legal representative, as applicable.
The aforementioned periods may be extended once for an equal term where justified by the circumstances of the case.
The delivery of personal data shall be free of charge, except for justified shipping expenses or reproduction costs in copies or other formats.
If the applicant reiterates the same request within a period of less than twelve months, the corresponding costs established under the LFPDPPP must be covered, unless substantial modifications to the Privacy Notice justify new consultations.
X. CHANGES TO THE PRIVACY NOTICE:
The OPERATORS may amend this Privacy Notice at any time in order to implement improvements or incorporate new measures established by law or other regulations. Accordingly, you are advised to review its contents regularly.
Updates shall be published on the website.
XI. CONSENT:
You provide your express consent for the collection, processing, and use of your personal data in accordance with this Privacy Notice by expressing your will through written, electronic, or any other technological means, or by voluntarily providing the requested information.
You provide tacit consent to this Privacy Notice by not objecting to its contents within 48 hours following its publication on the website.
In some cases, the LFPDPPP allows the OPERATORS to collect, use, and disclose personal data without your consent.
If the OPERATORS obtain personal information through third parties, they shall require confirmation that the corresponding consent for disclosure has been obtained.
If you request that the OPERATORS revoke your consent, the OPERATORS shall take the necessary measures to destroy or eliminate the personal data you have provided, subject to the exceptions established in the LFPDPPP.
Residual personal information may remain in archived or historical records. Furthermore, the OPERATORS may not destroy tax or accounting information related to transactions that may be necessary to maintain or comply with legal obligations.
However, the OPERATORS shall not use your personal information for any other purposes once you revoke your consent.
XII. APPLICABLE LAW:
The interpretation and application of this Privacy Notice shall be governed by the Federal Law on the Protection of Personal Data Held by Private Parties, the Federal Civil Code, and all other applicable laws, regulations, and administrative provisions.
XIII. EFFECTIVE DATE:
This Privacy Notice shall become effective as of its publication date, except for Section IX regarding ARCO Rights, which became effective as of January 6, 2012, pursuant to the Third and Fourth Transitory Articles of the LFPDPPP.
XIV. MANIFESTATION OF CONSENT:
THE DATA SUBJECT expressly declares having read the contents of this Privacy Notice and having no objection thereto.
