INTEGRAL PRIVACY NOTICE

BENEFICIARIES

A. Identity and address of the Responsible party.

Under the provisions of the Personal Data Protection Federal Law ( LFPD) and other applicable provisions, Fundación Palace Resorts, I.A.P. (hereinafter referred to as “Fundación Palace®” indistinctly or the “Responsible party”), settled to hear and receive notifications at Cancun – Puerto Morelos Highway km 21, Manzana 01, Lote 1 – 11, Building A, Supermanzana 47, Municipality of Benito Juarez, Cancun, Quintana Roo, Mexico, C.P.77506, expressly informs:

B. Personal Data collected and subjected to treatment.

For the development of the purposes described in the previous Privacy Notice, we categorized the personal data as follows:

1) Identification character data.

2) Personal characteristics data.

3) Social circumstances data.

4) Academic and professional data.

5) Job occupation data.

6) Commercial information data

7) Economic, financial or insurance data.

8) Sensitive personal data (Health Data).

The entitled person (or legitimate legal representative in case of minors) will be responsible for communicating to any third party (relatives or contacts) about the processing of personal data provided for the compliance of the identified purposes,  by Fundación Palace ®,  if any, as well as the content of  this Integral Privacy  Notice.

C. Sensitive personal data treatment.

Health Data. For the compliance of the legitimate purposes described in the present Privacy Notice, Fundación Palace ® must collect personal data deemed as sensitive by the legislation in force, particularly, those that are referred to the present and/or future health conditions of the applicants for the benefits granted by Fundación Palace®.

Therefore, we request your express consent, in written   for the treatment of such sensitive personal data: I hereby give my consent to Fundación Palace® to treat my sensitive personal data for the purposes described in this Privacy Notice, as required, attending to the requested benefits’ nature.

D. Purpose of treatment.

a. Original and necessary purposes

  1. Management, control and administration of the requests to have access to the benefits granted by Fundación Palace®.
  2. Management, control and administration of particular benefits granted by Fundación Palace®, so that they are used to for the same altruistic purposes for which they were granted.
  3. Management, control, assessment and administration of the socioeconomic research studies required for the benefits granted by Fundación Palace®.
  4. Communication, publication and broadcast of the activities carried out by Fundación Palace®, including the identification of particular beneficiaries.
  5. Statistics and history record of the activities and benefits granted by Fundación Palace®.

b. Additional purposes.

  1. They don’t exist.

E. Transfer of personal data.

The personal data of beneficiaries, parents, tutors or legal representatives (including sensitive data) may be transferred and treated by people other than   Fundación Palace ®, in the following cases:

  1. Controlling societies, subsidiaries or affiliates of Palace Resorts Group®; with the purpose of saving centralizing information.
  2. Nonaffiliated third parties (service renderers), with the solely and exclusively purpose of assisting Fundación Palace®, with the management, control, assessment and administration of the socio-economic research studies to grant the benefits (in compliance with the legal relationship between  the  Responsible party and the  Entitled one).
  3. People who are subjected to a medical professional secret or equivalent obligation, in such cases in which the transfer of  the sensitive personal data, as regards your  present and future health conditions, towards a legally empowered third party,  whereas is essential to receive  medical attention, prevention, diagnosis or sanitary assistance, medical treatments or  management  of  sanitary services, while the Entitled party  is not in conditions  to grant his consent, under the terms stated  by the  Health  General  Law and other applicable legal provisions.

F. Consent for data transfer

The personal data transfer referred in the numbers 1 to 3 of the immediately preceding item, does not require a consent to be executed, according to what is stated   in the article 37 of the Data Protection Federal Law (LFPD). In every other case, the personal data won’t be transferred to third parties without previous consent, except the provisions  in the artice 37 of the Data Protection Federal Law (LFPD) and as long as they comply with the conditions established in the article 17 of the Data Protection federal Law Regulations.

G. Exercise of ARCO rights

In all those legally proceeding cases, you may exercise your rights of access, rectification, cancellation and opposition (ARCO rights) through the procedures that we have implemented.

The corresponding request shall comply with the requisites established by the legislation in force, through a writ addressed to our Personal Data Responsible Party, with address at Cancun – Puerto Morelos Highway km 21, Manzana 01, Lote 1 – 11, Building A, Supermanzana 47, Municipio Benito Juárez, Cancun, Quintana Roo, Mexico. C.P.77506. The request must contain and include the following:

I. Name and address or other mean to reply to the request.

II. The documents that accredit his identity or legal representation.

III. A clear and accurate description of the personal data as regards some of the ARCO legal rights to be exerted; and

IV. Any other element or document which makes the search of personal data easier.

The Responsible party will communicate, in a maximum term of twenty work days, starting from    the date   in which the corresponding request is received, the adopted determination. If the request results to proceed, this will take effect within the   next fifteen work days in which the Responsible party   replies.

In case that the information provided in the request results wrong or insufficient, or if it is not accompanied by the necessary documents to accredit its identity  or corresponding legal representation, the Responsible party, within the next five work days after receiving the request, will require the correction of deficiencies in order to arrange it. In these cases, you will have ten work days to attend the requirement of amendment, counting from the day after having received it. The corresponding requests will be considered as not submitted if you do not answer within such term.

You may obtain the requested personal information or data by means of simple copies, electronic documents in conventional form (Word, PDF, etc.), through the restricted and authorized access to the system which treats the personnel data (access) or through any other legitimate mean which guarantees and accredits the effective exercise of the requested right.

Alternatively, the entitled party may submit his request through derechosarco@palaceresorts.com, in compliance with all the formerly mentioned requisites, stating as subject “ARCO Rights and/or Revocation of consent”. The terms of the procedure will be the same as the ones referred in the immediately preceding paragraph. The use of electronic media for the exercise of ARCO rights authorizes the Responsible party to respond to the corresponding request through the same media, unless is otherwise indicated by the entitled party, clearly and expressly.

You will be responsible of maintaining the personal data in possession of the Responsible party updated. Therefore, you guarantee and respond in any case, for the veracity, validity and authenticity of the provided personal data, and it’s committed to maintain them duly updated, and communicate every change to the Responsible party.

H. Revocation of consent.

You can revoke your consent for the treatment of your personal data, without retroactive effects, in all those cases in which such revocation does not mean disabling the   compliance with  such obligations derived from a legal relationship in force between  you and the Responsible party.

The procedure to revoke the consent, in such case, will be the same one established in the immediately preceding item for the exercise of ARCO rights.

I. Limitations about giving out personal data.

You can limit the use or give-out of your personal data by addressing the corresponding   request to our Persona Data Department.  The requisites to accredit your identity, as well as the procedure to attend your request will be the same as the ones indicted in the Item G) of the present privacy Notice (ARCO rights exercise ARCO).

J. Modifications or updates to the present Integral Privacy Notice.

Fundación Palace® will be empowered to modify, update, extend or otherwise change the content and scope of the present Integral Privacy Warning, any time and under its sole discretion. In such cases, Fundación Palace® will publish such cases in the Web site www.palaceresorts.com, “Press Room” section.

 

COMPREHENSIVE PRIVACY NOTICE SOCIAL NETWORKS

A. Identity and domicile of Data Controller

In accordance with the Federal Law for the Protection of Data Held by Individuals (hereinafter referred to as LFPD) and in accordance with applicable provisions, Fundación Palace Resorts, I.A.P. (hereinafter and distinctively referred to as “Fundación Palace®” or as the “Data Controller”) having corporate domicile for hearing and receiving notifications at Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, Zip Code 77506, expressly informs:

B. Personal Data Collected and Subjected to Processing.

To fulfill the purposes established herein, Grupo Palace Resorts® processes the following categories of personal data:

a) Identity Data;

b) Personal Data;

c) Social Circumstances Data and

d) Labor Data

C. Processing of Sensitive Personal Data.

Fundación Palace® does not collect any sensitive personal data for any of the purposes listed herein below and data subjects using social networks shall restrain from submitting this type of data through the channels available at said networks.

D. Responsibilities of Fundación Palace® and of data subjects using the social networks of the social network services providers.

Fundación Palace® processes personal data of the data subjects using social networks by means of the access and management of the information that such data subjects using social networks publish or spread through the profiles they have created in each social network they use to link themselves to Data Controller. This processing also comprises the profiting of the personal data to disclose the activities of Fundación Palace® Fundación Palace® accesses, manages and takes advantage of the personal data of the data subjects using social networks solely during the term user data subjects are linked to the profiles that the Data Controller manages in every involved social network.

The data subjects using social networks shall be responsible for the truthfulness, accuracy and updating of the personal data they publish at their social network profiles. They shall also be responsible for the spread extent of information thereof and for access thereof which they consent or authorize to third-parties, by means of such profiles. Fundación Palace® suggests to all the data subjects using social networks to continuously check the privacy configuration of profiles thereof on each of the web pages they use to link themselves to the Data Controller.

The service providers of social networks are responsible for the databases created with the personal data of the users of such social networks. Such service providers are, in turn, responsible for the security measures they adopt to safeguard the personal data of users thereof. In accordance with the foregoing, Fundación Palace® shall be responsible for the due access, management and profiting of the personal data of the data subjects using social networks who are linked to the profiles Fundación Palace® manages in various social networks. Fundación Palace® does not create any new databases with he information and/or personal data of the data subjects using social networks.

E. Purposes of the Processing.

a. Initial and Necessary Purposes

  1. Managing followers at social networks (Facebook, Twitter, Youtube, Foursquare, Google+, Linkedin, etc.) and managing of the subscribers to the newsletters of Grupo Palace Resorts®.
  1. Communicating the activities of Fundación Palace®.
  1. Information and foster of our beneficiary activities.
  1. Making the statistics of the followers in social networks.

b. Additional Purposes.

  1. There are no additional purposes. F. Personal Data Transference. In furtherance of the stated purposes, Fundación Palace® does not transfer any data to third-parties.

G. Data Transference Consent.

Your personal data shall not be transferred to third-parties without your consent, except for the cases contemplated at LFPD article 37. In which case the transference shall be conducted while complying with the conditions described at LFPD Regulations article 17.

H. Exercise of the ARCO rights before Data Controller.

In all cases legally applicable, at all times, you may exercise your access, rectification, cancellation and opposition rights (ARCO rights) by means of the procedures we have implemented.

The relevant request shall meet the requirements of the effective legislation, by means of a document addressed to our Personal Data Responsible at Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P.77506.

The request shall contain the following:

I. Your name and domicile or any other means to answer your request.

II. The documents proving your identity or, if applicable, your legal powers.

III. A clear and precise description of the personal data with regard to which any ARCO Rights are to be enforced.

IV. Any other element or document facilitating the localization of your personal data.

Data Controller shall inform to you, within a maximum term of twenty business days, from the date when Data Controller receives the relevant request, the resolution thereof. In case the request was accepted, the request shall become effective within the fifteen business days after the date when Data Controller communicates the resolution. In the event the information provided at your requests turns out to be untrue or insufficient or in the event they are not included the documents required to prove your identity or the relevant legal powers, the Data Controller, within the five business days after the receipt of the request, shall require that deficiencies be corrected in order to process the request. In which case, you shall have ten business days to fulfill the correction requirement, from the day after receipt thereof. The relevant request shall be deemed as not presented in case you fail to conduct the correction within said term.

You may obtain the requested information or personal data by means of simple copies, electronic documents in conventional format (Word, PDF, etc.), by means of a restricted access authorized to the system processing your personal data (access) or through any other lawful means guaranteeing and accrediting the effective exercise of the requested right.

Alternatively, the Data Subject may address your request through the following address derechosarco@palaceresorts.com, complying with all the aforesaid requirements, establishing as Subject o the communication “ARCO Rights and/or Consent Revocation”. The terms for the proceeding shall be the sames as the ones mentioned in the foregoing paragraph. The use of the electronic means for the enforcement of the ARCO rights authorizes data subject to answer the relevant request through the same means, unless data subject himself expressly and clearly indicates otherwise.

I. Exercise of the ARCO rights before the social network service providers.

The exercise of the ARCO rights before the social network service providers at which the data subjects using such networks have created a profile shall be governed in accordance with the applicable legislation, under the terms and conditions set forth in the Privacy Notices, Privacy Policies and/o Legal Notices each service provider has established in the social networks they operate and manage.

J. Consent Revocation.

You may revoke your consent for the processing of your personal data, without any retroactive effects, in case such a revocation does not entail that it is not possible to fulfill the obligations arising from an effective legal relation between you and the Data Controller.

You may revoke your consent for the processing of your personal data by disassociating yourself from the profile of the Data Subject, at any of the corresponding social networks.

The procedure for the revocation of the consent, if applicable, shall be the same as the one established in section H) for the exercise of the ARCO rights.

K. Limitations to the Disclosure of Your Personal Data.

You may limit the usage or disclosure of your personal data by addressing the relevant request to our Personal Data Department. The requirements for accrediting your identity, as well as the procedure for processing your request shall be the same as the ones indicated at section H) hereof (ARCO rights exercise).

However, we remind you that you as data subject using the social networks are responsible for the truthfulness, accuracy and updating of the personal data you publish at your social network profiles. They shall also be responsible for the spread extent of information thereof and for access thereof which you consent or authorize to third-parties, by means of such profiles.

L. Amendments or Updating to this Comprehensive Privacy Notice.

The Data Controller may amend, update, extend or otherwise change the form, content and scope hereof at any time and at its sole discretion. In such cases, Fundación Palace® shall publish said amendments in the website www.fundacionpalace.org, section “Privacy Notices”. Amendments hereto may also be communicated by means of the profiles of the Data Controller at the relevant social networks, should interface thereof allows so.

 

COMPREHENSIVE PRIVACY NOTICE DONERS

A. Identity and domicile of Data Controller

In accordance with the Federal Law for the Protection of Data Held by Individuals (hereinafter referred to as LFPD) and in accordance with applicable provisions, Fundación Palace Resorts, I.A.P. (hereinafter and distinctively referred to as “Fundación Palace®” or as the “Data Controller”) having corporate domicile for hearing and receiving notifications at Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, Zip Code 77506, expressly informs:

B. Personal Data Collected and Subjected to Processing.

For the fulfillment of the purposes described herein, we collect the following personal data categories:

1) Identity Data;

2) Labor Data

3) Economy, financial and insurance data.

C. Processing of Sensitive Personal Data.

Fundación Palace® does not collect any sensitive personal data for the purposes listed herein below.

D. Purposes of the Processing.

a. Initial and Necessary Purposes

  1. Management, control and administration of the donations conducted by individuals and legal entities in favor of Fundación Palace®.
  1. Management, control and administration of the donations made in kind in favor of the beneficiaries.
  1. Communication of the activities of Fundación Palace®
  1. Statistics and historical registry of the donations made in favor of Fundación Palace®.

b. Additional Purposes.

  1. There are no additional purposes.

E. Personal Data Transference.

Your personal data shall not be transferred to third-parties without your consent, except for the cases contemplated at LFPD article 37. In which case the transference shall be conducted while complying with the conditions described at LFPD Regulations article 17.

F. Exercise of the ARCO rights.

In all cases legally applicable, at all times, you may exercise your access, rectification, cancellation and opposition rights (ARCO rights) by means of the procedures we have implemented.

The relevant request shall meet the requirements of the effective legislation, by means of a document addressed to our Personal Data Responsible at Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P.77506.

The request shall contain the following:

I. Your name and domicile or any other means to answer your request.

II. The documents proving your identity or, if applicable, your legal powers.

III. A clear and precise description of the personal data with regard to which any ARCO Rights are to be enforced.

IV. Any other element or document facilitating the localization of your personal data.

Data Controller shall inform to you, within a maximum term of twenty business days, from the date when Data Controller receives the relevant request, the resolution thereof. In case the request was accepted, the request shall become effective within the fifteen business days after the date when Data Controller communicates the resolution. In the event the information provided at your requests turns out to be untrue or insufficient or in the event they are not included the documents required to prove your identity or the relevant legal powers, the Data Controller, within the five business days after the receipt of the request, shall require that deficiencies be corrected in order to process the request. In which case, you shall have ten business days to fulfill the correction requirement, from the day after receipt thereof. The relevant request shall be deemed as not presented in case you fail to conduct the correction within said term.

You may obtain the requested information or personal data by means of simple copies, electronic documents in conventional format (Word, PDF, etc.), by means of a restricted access authorized to the system processing your personal data (access) or through any other lawful means guaranteeing and accrediting the effective exercise of the requested right.

Alternatively, the Data Subject may address your request through the following address derechosarco@palaceresorts.com, complying with all the aforesaid requirements, establishing as Subject o the communication “ARCO Rights and/or Consent Revocation”. The terms for the proceeding shall be the sames as the ones mentioned in the foregoing paragraph. The use of the electronic means for the enforcement of the ARCO rights authorizes data subject to answer the relevant request through the same means, unless data subject himself expressly and clearly indicates otherwise.

You shall be responsible for the updating of your personal data possessed by the Data Controller. Therefore, you guarantee and shall bear the cost, at any time, for the truthfulness, accuracy, effectiveness and authenticity of the personal data provided. You commit to duly update them and to notify so to the Data Controller.

G. Consent Revocation.

You may revoke your consent for the processing of your personal data, without any retroactive effects, in case such a revocation does not entail that it is not possible to fulfill the obligations arising from an effective legal relation between you and the Data Controller. The procedure for the revocation of the consent, if applicable, shall be the same as the ne established in section above for the exercise of the ARCO rights.

H. Limitations to the Disclosure of Your Personal Data.

You may limit the usage or disclosure of your personal data by addressing the relevant request to our Personal Data Department. The requirements for accrediting your identity, as well as the procedure for processing your request shall be the same as the ones indicated at section F) hereof (ARCO rights exercise).

I. Amendments or Updating to this Comprehensive Privacy Notice.

Fundación Palace® may amend, update, extend or otherwise change the form, content and scope hereof at any time and at its sole discretion. In such cases, Fundación Palace® shall publish said amendments in the website www.fundacionpalace.org, section “News Room”.