A. Identity and domicile of Data Controller

In accordance with the Federal Law for the Protection of Data Held by Individuals (hereinafter referred to as LFPD) and in accordance with applicable provisions, Fundación Palace Resorts, I.A.P. (hereinafter and distinctively referred to as “Fundación Palace®” or as the “Data Controller”) having corporate domicile for hearing and receiving notifications at Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, Zip Code 77506, expressly informs:

B. Personal Data Collected and Subjected to Processing.

For the fulfillment of the purposes described herein, we collect the following personal data categories:

1) Identity Data;

2) Labor Data

3) Economy, financial and insurance data.

C. Processing of Sensitive Personal Data.

Fundación Palace® does not collect any sensitive personal data for the purposes listed herein below.

D. Purposes of the Processing.

a. Initial and Necessary Purposes

1. Management, control and administration of the donations conducted by individuals and legal entities in favor of Fundación Palace®.

2. Management, control and administration of the donations made in kind in favor of the beneficiaries.

3. Communication of the activities of Fundación Palace®

4. Statistics and historical registry of the donations made in favor of Fundación Palace®.

b. Additional Purposes.

1. There are no additional purposes.

E. Personal Data Transference.

Your personal data shall not be transferred to third-parties without your consent, except for the cases contemplated at LFPD article 37. In which case the transference shall be conducted while complying with the conditions described at LFPD Regulations article 17.

F. Exercise of the ARCO rights.

In all cases legally applicable, at all times, you may exercise your access, rectification, cancellation and opposition rights (ARCO rights) by means of the procedures we have implemented.

The relevant request shall meet the requirements of the effective legislation, by means of a document addressed to our Personal Data Responsible at Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P.77506.

The request shall contain the following:

I. Your name and domicile or any other means to answer your request.

II. The documents proving your identity or, if applicable, your legal powers.

III. A clear and precise description of the personal data with regard to which any ARCO Rights are to be enforced.

IV. Any other element or document facilitating the localization of your personal data.

Data Controller shall inform to you, within a maximum term of twenty business days, from the date when Data Controller receives the relevant request, the resolution thereof. In case the request was accepted, the request shall become effective within the fifteen business days after the date when Data Controller communicates the resolution. In the event the information provided at your requests turns out to be untrue or insufficient or in the event they are not included the documents required to prove your identity or the relevant legal powers, the Data Controller, within the five business days after the receipt of the request, shall require that deficiencies be corrected in order to process the request. In which case, you shall have ten business days to fulfill the correction requirement, from the day after receipt thereof. The relevant request shall be deemed as not presented in case you fail to conduct the correction within said term.

You may obtain the requested information or personal data by means of simple copies, electronic documents in conventional format (Word, PDF, etc.), by means of a restricted access authorized to the system processing your personal data (access) or through any other lawful means guaranteeing and accrediting the effective exercise of the requested right.

Alternatively, the Data Subject may address your request through the following address, complying with all the aforesaid requirements, establishing as Subject o the communication “ARCO Rights and/or Consent Revocation”. The terms for the proceeding shall be the sames as the ones mentioned in the foregoing paragraph. The use of the electronic means for the enforcement of the ARCO rights authorizes data subject to answer the relevant request through the same means, unless data subject himself expressly and clearly indicates otherwise.

You shall be responsible for the updating of your personal data possessed by the Data Controller. Therefore, you guarantee and shall bear the cost, at any time, for the truthfulness, accuracy, effectiveness and authenticity of the personal data provided. You commit to duly update them and to notify so to the Data Controller.

G. Consent Revocation.

You may revoke your consent for the processing of your personal data, without any retroactive effects, in case such a revocation does not entail that it is not possible to fulfill the obligations arising from an effective legal relation between you and the Data Controller. The procedure for the revocation of the consent, if applicable, shall be the same as the ne established in section above for the exercise of the ARCO rights.

H. Limitations to the Disclosure of Your Personal Data.

You may limit the usage or disclosure of your personal data by addressing the relevant request to our Personal Data Department. The requirements for accrediting your identity, as well as the procedure for processing your request shall be the same as the ones indicated at section F) hereof (ARCO rights exercise).

I. Amendments or Updating to this Comprehensive Privacy Notice.

Fundación Palace® may amend, update, extend or otherwise change the form, content and scope hereof at any time and at its sole discretion. In such cases, Fundación Palace® shall publish said amendments in the website, section “News Room”.