In order to prevent the spread and dissemination of COVID-19 and as part of the security and disease prevention measures to protect our guests and staff members, we have implemented an information and monitoring process based on the “Operational Considerations for COVID-19 Management in the Accommodation Sector” of the World Health Organization, the “Strategy for the Reopening of Social, Educational and Economic Activities” of the Mexican Federal Government and the Guidelines of the Ministry of Health of Mexico.

A. Identity and domicile of Data Controller.

In compliance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPD – Mexican acronym) and other applicable regulations, Hotelera Palace Resorts S. de R.L. de C.V. (hereinafter commonly referred to as "Grupo Palace Resorts®" or "Data Controller", whose domicile to hear and receive communications is: Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P. 77506, expressly states:

B. Personal data collected and processed.

For the purposes described in this Privacy Notice we collect the following types of personal data:
a) Identification data.
b) Insurance data.
c) Sensitive data (health data).
For the fulfillment of the purposes described in this Privacy Notice, we must process sensitive personal data related to your health status. When you "Check in" at any of our Resorts, as well as prior to your access to some of our services, such as SPA, you must fill out a form with information regarding your health status, and during your stay we will take your body temperature, this last information will be obtained directly from you by electronic means. We may also collect the results of the Covid-19 tests that you, at your free choice and within the framework of the Purely Palace program, decide to take in our facilities.

C. Purposes of the processing.

a. Grupo Palace Resorts® will process your personal data for the following primary purposes:
Adopt safety and disease prevention actions in the facilities of Grupo Palace Resorts®, to protect our guests and staff members.
Implement a monitoring process to prevent the spread and dissemination of COVID-19, according to the “Operational Considerations for COVID-19 Management in the Accommodation Sector” of the World Health Organization, the “Strategy for the Reopening of Social, Educational and Economic Activities” of the Mexican Federal Government and Guidelines of the Ministry of Health of Mexico.
Instruct our staff members to adopt the disease prevention measures of the Purely Palace program, including instructions for our guests to use hydroalcoholic gel and / or face masks when necessary.
Where appropriate, and under objective criteria related to the symptoms of COVID-19, refer our guests to medical services and special facilities for additional evaluations.
Where applicable, communicate the personal data of our guests with their insurance companies to facilitate the procedures they have before these companies.
b. Additional purposes:
We will not use your personal data for additional purposes.

D. Transfer of personal data.

We inform you that your personal data could be shared within and outside the territory of Mexico, in the following cases, to the following recipients and for the following purposes:
To Judicial or administrative authorities, for the fulfillment of obligations provided by the General Health Law of Mexico or in agreements issued for the fulfillment of the General Health Law of México during the state of the sanitary emergency period declared on March 30, 2020 by the World Health Organization.
Guest´s insurance companies, when applicable, in order to facilitate the procedures that our guests have before their insurance companies.
Pursuant to article 37 of the LFPD, the data transfer described in section 1 does not require your consent in order to be carried out. Any transfer of your personal data that requires your consent will be previously informed, through communication and / or updating of this Privacy Notice and prior to the completion of that data communication.
Acceptance of this Privacy Notice through the electronic means that Grupo Palace Resorts® uses to collect personal data, in particular through the website www.palaceresorts.com, or to communicate its Privacy Notices, entails your consent to carry out the transfer of your personal data to "Guest insurance companies".
In all those legally valid cases, you may communicate to Grupo Palace Resorts®, at any time and without retroactive effects, your desire to revoke consent for the future transfer of your personal data.

E. Exercise of ARCO rights.

Under all legal circumstances you may exercise your rights of access, rectification, cancellation or objection (ARCO rights) using the legal procedures we have set up.
Such requests shall comply with the applicable legal requirements and be addressed to our Data Protection Officer, whose domicile is Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P.77506.
The requests shall contain the following:
I. Your name and address or other means of providing you with a response.
II. Valid identification documents or power of attorney, as the case may be.
III. A clear and precise description of the personal data on which you wish to exercise your ARCO Rights; and
IV. Any other element or document that could facilitate locating your personal data.
Grupo Palace Resorts® will answer you with a decision within 20 business days counted from the date on which your request is received. If the request is admissible it will be put into effect within 15 business days following the date on which Data Controller advises you of the decision. In the event that the information you provide is incorrect or insufficient, or if you fail to send the necessary identity documents or power of attorney, Data Controller will ask that you correct such deficiencies within 5 business days after receiving your request and you will have 10 business days to comply, counted from the day after you receive such notice. The process will be terminated if you do not answer within the required time.
You can obtain the requested personal data by means of authorized restricted access to the databanks (access) containing your personal information or by any other legitimate means that guarantee and evidence the exercise of the requested right.
Alternatively, after fulfilling all the above-mentioned requirements, Data Subject may submit his/her request by e-mail to derechosarco@palaceresorts.com and indicating "ARCO Rights and/or Consent Revoked" in the Subject line. Response times will remain the same as those mentioned in the immediately preceding paragraph. The use of electronic means in the exercise of ARCO rights authorizes Data Controller to answer the request using the same means unless Data Subject specifically requests another format.

F. Revoking consent.

You may revoke your consent to have your personal data processed, without retroactive effect, in all cases in which said revocation does not make it impossible to fulfill any obligations arising from a legal relation in force between you and Data Controller. The process for revoking consent will be the same as the one established in the immediately preceding section on how to exercise your ARCO rights.

G. Limitations on the disclosure of your personal data.

The processing of your personal data for the purposes established in this privacy notice entails a legal limitation on the use or disclosure of your personal data to the strictly necessary to fulfill said purposes; Grupo Palace Resorts® cannot use or disclose your personal data for any other purpose.
Notwithstanding the foregoing, you can request the limitation on the use or disclosure of your personal data by express and written request in this regard. The requirements and the follow-up procedure will be the same as those defined for the exercise of the ARCO rights, established in this privacy notice.

H. Amendments or updates of this Full Privacy Notice.

Data Controller may amend, update, extend or in any other way change the content and scope of this Full Privacy Notice at any time and at its complete discretion. In such cases Grupo Palace Resorts® will publish those changes on its www.palaceresorts.com website in the section "Privacy Notices".

Last updated
December 1st, 2021.