INTEGRAL PRIVACY NOTICE

BENEFICIARIES

A. Identity and address of the Responsible party.

Under the provisions of the Personal Data Protection Federal Law ( LFPD) and other applicable provisions, Fundación Palace Resorts, I.A.P. (hereinafter referred to as “Fundación Palace®” indistinctly or the “Responsible party”), settled to hear and receive notifications at Cancun – Puerto Morelos Highway km 21, Manzana 01, Lote 1 – 11, Building A, Supermanzana 47, Municipality of Benito Juarez, Cancun, Quintana Roo, Mexico, C.P.77506, expressly informs:

B. Personal Data collected and subjected to treatment.

For the development of the purposes described in the previous Privacy Notice, we categorized the personal data as follows:

1) Identification character data.

2) Personal characteristics data.

3) Social circumstances data.

4) Academic and professional data.

5) Job occupation data.

6) Commercial information data

7) Economic, financial or insurance data.

8) Sensitive personal data (Health Data).

The entitled person (or legitimate legal representative in case of minors) will be responsible for communicating to any third party (relatives or contacts) about the processing of personal data provided for the compliance of the identified purposes,  by Fundación Palace ®,  if any, as well as the content of  this Integral Privacy  Notice.

C. Sensitive personal data treatment.

Health Data. For the compliance of the legitimate purposes described in the present Privacy Notice, Fundación Palace ® must collect personal data deemed as sensitive by the legislation in force, particularly, those that are referred to the present and/or future health conditions of the applicants for the benefits granted by Fundación Palace®.

Therefore, we request your express consent, in written   for the treatment of such sensitive personal data: I hereby give my consent to Fundación Palace® to treat my sensitive personal data for the purposes described in this Privacy Notice, as required, attending to the requested benefits’ nature.

D. Purpose of treatment.

a. Original and necessary purposes

1. Management, control and administration of the requests to have access to the benefits granted by Fundación Palace®.

2. Management, control and administration of particular benefits granted by Fundación Palace®, so that they are used to for the same altruistic purposes for which they were granted.

3. Management, control, assessment and administration of the socioeconomic research studies required for the benefits granted by Fundación Palace®.

4. Communication, publication and broadcast of the activities carried out by Fundación Palace®, including the identification of particular beneficiaries.

5. Statistics and history record of the activities and benefits granted by Fundación Palace®.

b. Additional purposes.

1. They don’t exist.

E. Transfer of personal data.

The personal data of beneficiaries, parents, tutors or legal representatives (including sensitive data) may be transferred and treated by people other than   Fundación Palace ®, in the following cases:

1. Controlling societies, subsidiaries or affiliates of Palace Resorts Group®; with the purpose of saving centralizing information.

2. Nonaffiliated third parties (service renderers), with the solely and exclusively purpose of assisting Fundación Palace®, with the management, control, assessment and administration of the socio-economic research studies to grant the benefits (in compliance with the legal relationship between  the  Responsible party and the  Entitled one).

3. People who are subjected to a medical professional secret or equivalent obligation, in such cases in which the transfer of  the sensitive personal data, as regards your  present and future health conditions, towards a legally empowered third party,  whereas is essential to receive  medical attention, prevention, diagnosis or sanitary assistance, medical treatments or  management  of  sanitary services, while the Entitled party  is not in conditions  to grant his consent, under the terms stated  by the  Health  General  Law and other applicable legal provisions.

F. Consent for data transfer

The personal data transfer referred in the numbers 1 to 3 of the immediately preceding item, does not require a consent to be executed, according to what is stated   in the article 37 of the Data Protection Federal Law (LFPD). In every other case, the personal data won’t be transferred to third parties without previous consent, except the provisions  in the artice 37 of the Data Protection Federal Law (LFPD) and as long as they comply with the conditions established in the article 17 of the Data Protection federal Law Regulations.

G. Exercise of ARCO rights

In all those legally proceeding cases, you may exercise your rights of access, rectification, cancellation and opposition (ARCO rights) through the procedures that we have implemented.

The corresponding request shall comply with the requisites established by the legislation in force, through a writ addressed to our Personal Data Responsible Party, with address at Cancun – Puerto Morelos Highway km 21, Manzana 01, Lote 1 – 11, Building A, Supermanzana 47, Municipio Benito Juárez, Cancun, Quintana Roo, Mexico. C.P.77506. The request must contain and include the following:

I. Name and address or other mean to reply to the request.

II. The documents that accredit his identity or legal representation.

III. A clear and accurate description of the personal data as regards some of the ARCO legal rights to be exerted; and

IV. Any other element or document which makes the search of personal data easier.

The Responsible party will communicate, in a maximum term of twenty work days, starting from    the date   in which the corresponding request is received, the adopted determination. If the request results to proceed, this will take effect within the   next fifteen work days in which the Responsible party   replies.

In case that the information provided in the request results wrong or insufficient, or if it is not accompanied by the necessary documents to accredit its identity  or corresponding legal representation, the Responsible party, within the next five work days after receiving the request, will require the correction of deficiencies in order to arrange it. In these cases, you will have ten work days to attend the requirement of amendment, counting from the day after having received it. The corresponding requests will be considered as not submitted if you do not answer within such term.

You may obtain the requested personal information or data by means of simple copies, electronic documents in conventional form (Word, PDF, etc.), through the restricted and authorized access to the system which treats the personnel data (access) or through any other legitimate mean which guarantees and accredits the effective exercise of the requested right.

Alternatively, the entitled party may submit his request through derechosarco@palaceresorts.com, in compliance with all the formerly mentioned requisites, stating as subject “ARCO Rights and/or Revocation of consent”. The terms of the procedure will be the same as the ones referred in the immediately preceding paragraph. The use of electronic media for the exercise of ARCO rights authorizes the Responsible party to respond to the corresponding request through the same media, unless is otherwise indicated by the entitled party, clearly and expressly.

You will be responsible of maintaining the personal data in possession of the Responsible party updated. Therefore, you guarantee and respond in any case, for the veracity, validity and authenticity of the provided personal data, and it’s committed to maintain them duly updated, and communicate every change to the Responsible party.

H. Revocation of consent.

You can revoke your consent for the treatment of your personal data, without retroactive effects, in all those cases in which such revocation does not mean disabling the   compliance with  such obligations derived from a legal relationship in force between  you and the Responsible party.

The procedure to revoke the consent, in such case, will be the same one established in the immediately preceding item for the exercise of ARCO rights.

I. Limitations about giving out personal data.

You can limit the use or give-out of your personal data by addressing the corresponding   request to our Persona Data Department.  The requisites to accredit your identity, as well as the procedure to attend your request will be the same as the ones indicted in the Item G) of the present privacy Notice (ARCO rights exercise ARCO).

J. Modifications or updates to the present Integral Privacy Notice.

Fundación Palace® will be empowered to modify, update, extend or otherwise change the content and scope of the present Integral Privacy Warning, any time and under its sole discretion. In such cases, Fundación Palace® will publish such cases in the Web site www.palaceresorts.com, “Press Room” section.