GENERAL PRIVACY NOTICE USERS

A. Identity and address of Controller.

In accordance with the provisions of the Federal Law for the Protection of Personal Information Held by Third Parties (LFPD – Mexican acronym) and other applicable regulations, Hotelera Palace Resorts, S. de R.L. de C.V. (hereinafter commonly referred to as "Grupo Palace Resorts" or "Controller", whose domicile to hear and receive communications is: Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P. 77506, expressly states:

B. Personal information collected and processed.

For the purposes described in this Privacy Notice we collect the following types of personal information:

• 1) Identification and contact data.
• 2) Personal characteristics.
• 3) Income, financial and insurance information.
• 4) Geolocation Data.
• 5) Sensitive information (health and biometrics).

Grupo Palace Resorts® does not directly collect personal information on minors through its webpage, and minors must abstain from providing such information. Grupo Palace Resorts® processes personal information on minors only when such information is provided by the parents and/or tutors, and with their consent in all cases, when such information is needed to fulfill the relevant purposes described in this Privacy Notice.
Parents and/or tutors who provide information on minors in relation to this Privacy Notice will be informed of its content as provided by law.
Parents and/or tutors may invoke their ARCO rights at any time and revoke their consent to the processing of a minor's information they may have provided for any purpose related to the services or activities provided in the Grupo Palace Resorts®.

C. Processing of sensitive data. Health status and Biometric Data.

In specific cases, Grupo Palace Resorts® has a legal obligation to collect sensitive personal information related to your state of health.
Such personal sensitive information will be processed to comply with the purposes described in this Privacy Notice, and in particular for the performance of services offered by Controller whose nature requires Controller to adopt special measures to ensure the well-being and/or health of our guests.
When such sensitive personal information is required by Grupo Palace Resorts® the owners of such information may refuse to supply it, in which case Grupo Palace Resorts® will reserve the right to provide or deny the specific service requested.
Grupo Palace Resorts® may also process sensitive personal information related to a person's state of health when such information is provided by its owner for the purpose of obtaining special assistance or services that are expressly required for their stay in our facilities.
Therefore, and only when it is strictly necessary, we will request your express consent in writing before processing such sensitive personal information, using a media that will provide adequate information on such processing.
On a voluntary basis, you may provide biometric data for identification purposes in our facilities and services.
In all cases, Grupo Palace Resorts® will inform you in advance if you may provide said biometric data, requesting your explicit and written consent in order to process them for the indicated purposes.

D. Purpose of processing.

• a. Relevant and necessary purposes.
  1. To provide express purchased services, in any of their modes, related to your stay in any of the Grupo Palace Resorts® facilities.
  2. Ensure the functionality and quality of services purchased through specific programs that guarantee personalized attention to your needs, safety of guests in all Grupo Palace Resorts® and, as the case may be, the purchase or confirmation of services provided by third parties to users and purchased before or during their stay.3. Provide assistance, deliver information and help the user to purchase in-house or third-party services throughout their stay with Grupo Palace Resorts®.
  4. To allow you access to our online services if you are eligible and choose such access.
  5. Announce changes in our services.
  6. Invoicing of delivered goods and services, as well as the legal or third-party collection of debts
  7. Keeps statistics and historical records of our users.
• b. Additional purposes.
  1. Announcement of promotions and new products and/or services offered by Grupo Palace Resorts®.
  2. Satisfaction surveys.

E. Additional purposes. Refusal of processing.

I do not wish to receive promotions and new products and/or services provided by Grupo Palace Resorts®.
You may revoke your consent for the processing of your personal information in relation to the indicated additional purposes using the mechanisms provided in this Privacy Notice and by the applicable legislation.

F. Transfer of personal information.

Your personal information (including sensitive information) may be transferred to and shared by persons other than Controller. The receivers of such information (domestic and international) belong to the following categories:
1. Controlling company, subsidiaries or affiliates of Grupo Palace Resorts®; for the purpose of centralizing information, corporate distribution of advertising and/or viral promotions or collection of statistics, in order to evaluate, improve and design advertising campaigns.
2. Nonaffiliated third parties (service providers), solely so that they may assist Grupo Palace Resorts® in the performance of services related with service reservations and the purchase of additional services that are necessary or expressly required by the Owner during their stay (complying with the legal relation existing between Controller and Owner and or executed or pending contracts and benefits of the Owner, by Controller or a third party).
3. Persons subject to professional medical secrecy or an equivalent obligation, pursuant to the General Health Law and other applicable legislation; when the transfer of sensitive personal information related to your present or future state of health to any third party legally able to receive it, is indispensable for medical care, prevention, diagnostic, health assistance, medical treatment or the management of health services, in cases when the owner of such information is unable to grant their consent.
4. Collection agencies, for the recovery of unpaid loans through the courts or by settlement.
5. Business partners, to promote and/or sponsor products, services and special offers.

G. Consent for the sharing of information.

Pursuant to article 37 of the LFPD, the sharing of personal information described in paragraphs 1 through 5 of the preceding section does not require your consent.
The sharing of your personal information under paragraph 5 of the preceding section requires your consent.
I consent to have my personal information shared with the third parties identified as "Business Partners" for the stated purposes.
Acceptance of this Privacy Notice through electronic media which Grupo Palace Resorts® uses to collect personal data, especially through its webpage www.palaceresorts.com, means you agree to have your personal information shared with its "Business Partners".
You can notify Grupo Palace Resorts® at any time to withdraw your consent for the future sharing of your personal information.
In all other cases, your personal information will not be shared with third parties without your consent, except the exceptions described in article 37 of the LFPD and in compliance with the conditions of article 17 of the LFPD Regulations.

H. Exercise of ARCO rights.

Under all legal circumstances you may exercise your rights to access, modify, cancel and oppose information (ARCO rights) using the legal procedures we have set up.
All such requests should be sent in writing to the address indicated in paragraph A of this Notice addressed to our Controller of Personal Information, and comply with the applicable legal requirements.
Information requests should contain the following:

• I. Your name and address or other means of providing you with a response.
• II. Valid identification documents or power of attorney, as the case may be.
• III. A clear and precise description of the personal information on which you wish to exercise your ARCO Rights; and
• IV. Any other element or document that could facilitate locating your personal information.

Controller will answer you with a decision within 20 business days counted from the date on which your request is received. If the request is admissible it will be put into effect within 15 business days following the date on which Controller advises you of the decision. In the event that the information you provide is incorrect or insufficient, or if you fail to send the necessary identity documents or power of attorney, Controller will ask that you correct such deficiencies within five business days after receiving your request and you will have 10 business days to comply, counted from the day after you receive such notice. The process will be terminated if you do not answer within the required time.
You can obtain the requested personal information in the form of plain copies or electronic documents in common formats (Word, PDF, etc.), by means of authorized restricted access to the databanks (access) containing your personal information or by any other legal means that guarantee and evidence the exercise of the requested right.
Alternatively, after fulfilling all the above-mentioned requirements, the Owner may submit their request by e-mail to derechosarco@palaceresorts.com and indicating "ARCO Rights and/or Consent Revoked" in the Subject line. Response times will remain the same as those mentioned in the immediately preceding paragraph. The use of electronic media in the exercise of ARCO rights authorizes Controller to answer the request using the same media unless the petitioner specifically requests another format.
You will be responsible for maintaining your personal information in possession of Controller updated. Therefore, under all circumstances you are responsible for the truth, accuracy, validity and quality of the personal information you provide, and you hereby undertake to keep such information updated by informing Controller of any changes.

I. Revoking consent.

You may revoke your consent to have your personal information processed, without retroactive effect, in all cases in which said revocation does not make it impossible to fulfill any obligations arising from the legal relation in force between you and Controller.
The process for revoking consent will be the same as the one established in the immediately preceding section on how to exercise your ARCO rights.

J. Limitations on the disclosure of your personal information.

You may limit the use or disclosure of your personal information by sending our Personal Information Department a request to that effect. The requirements for personal identification and the procedure for answering your request remain the same as those indicated in the section on "Exercise of ARCO Rights".
Controller has the resources and procedures to ensure that some of your information is included in a Personal Exclusion List, on condition that you expressly request the inclusion of such information in said list. Controller will then issue to all registered owners [of said information] a letter certifying their inclusion in said list.

K. Automatic personal information collection media.

Grupo Palace Resorts® uses cookies to facilitate navigation on the website www.palaceresort.com. Cookies are a tool used by Web servers to save and recover information stored in your browser in order to save your personal preferences and provide a better browsing experience when you visit a website.
Cookies have an expiry date which may vary during any single session or visit to the website and will expire on a specific date counted from the time they become active. Most cookies used by www.palaceresorts.com are associated with a single anonymous user and their equipment, they do not provide information that can be used to obtain the name of a User, they cannot read information from your hard disk nor insert a virus in your texts.
We can also gather information using "web beacons", "pixel tags", "clear gifs" or similar means (generically called "web beacons") which allow us to collect nonpersonal or added information such as domain names, the site areas you visit, operating system you use, version of your system, browser version and the URL you last visited. This information is used to improve your experience on the site and analyze traffic patterns.
We may also use third party advertising on our sites. These advertisers may also use cookies and pixel tags to identify among other things, what advertisements you viewed and on what pages.
Grupo Palace Resorts® does not have control over the use of this technology by third parties and therefore we cannot be held liable for their actions and policies.
You may configure your browser to accept or reject cookies automatically or to receive a notification that will allow you to decide whether to accept or reject that cookie. Even when you configure your browser to reject all cookies or to expressly reject cookies from www.palaceresorts.com, you will be able to continue browsing the website but not all its features will be available. In any case, you can eliminate www.palaceresorts.com cookies at any time by following the procedure indicated in the Help section of your browser.

L. Modifications or updates of this General Privacy Notice.

Controller may modify, update, extend or in any other way change the content and scope of this General Privacy Notice at any time and at its complete discretion. In such cases Grupo Palace Resorts® will publish those changes on its www.palaceresorts.com website in the section "Privacy Notices".
Grupo Palace Resorts® may also announce changes to this Privacy Notice by e-mail when such a mode of correspondence has been agreed upon.

Last updated
December 1st, 2021.