A. Identity and domicile of Data Controller.
In accordance with the Federal Law for the Protection of Data Held by Individuals (hereinafter referred to as LFPD) and in accordance with applicable provisions, Palace Premier, S.A. de C.V. (hereinafter and distinctively referred to as "Palace Premier®" or as the "Data Controller") having corporate domicile for hearing and receiving notifications at Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, Zip Code 77506, expressly informs:

B. Personal Data Collected and Subjected to Processing.
For the fulfillment of the purposes described herein, we collect the following personal data categories: 1) Identity Data; 2) Personal Data; 3) Social Circumstances Data; 4) Labor Data and 5) Economy, financial and insurance data.
Additionally, we inform to you that the personal data of third-parties provided by you to the Data Controller for the fulfillment of the purposes identified (for instance, data of recommended people or references) shall be provided after they have been informed over the existence of the processing and over the content hereof.

C. Processing of Sensitive Personal Data.
Data Controller does not collect any sensitive personal data for the purposes listed herein below.

D. Purposes of the Processing.
a. Initial and Necessary Purposes 1. To inform to the interest party about the benefits of the affiliation to Palace Premier Resorts, including modalities and prices thereof. 2. To facilitate the engagement of the services offered by Palace Premier®. 3. To consult the credit history and the credit request. b. Additional Purposes. 1. Submitting communications on offers and new products and/or services provided by Palace Premier®.

E. Additional Purposes. Processing Denial.
I do not want to receive any communications on offers and new products and/or services provided by Palace Premier®.

F. Personal Data Transference.
Your personal data may be transferred and processed by people different from Data Controller. The recipients of such transferences (either national or foreign) correspond to the following categories: 1. Credit information corporations, in order to guarantee that the interested parties have an appropriate credit history for the affiliation to Palace Premier®. 2. Financial Entities, in order to request the personal credits for your affiliation to Palace Premier®.

G. Data Transference Consent.
In order to conduct the personal data transferences mentioned under numbers 1 and 3 of section herein above, we require your consent for the conduction thereof. I consent the transference of my data to the third-parties identified as "Credit information corporations" and/or "Financial entities", for the identified purposes. For the rest of the cases, your personal data shall not be transferred to third-parties without your consent, except for the cases contemplated at LFPD article 37. In which case the transference shall be conducted while complying with the conditions described at LFPD Regulations article 17.

H. Exercise of the ARCO rights.
In all cases legally applicable, at all times, you may exercise your access, rectification, cancellation and opposition rights (ARCO rights) by means of the procedures we have implemented. The relevant request shall meet the requirements of the effective legislation, by means of a document addressed to our Personal Data Responsible at Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P.77506. The request shall contain the following: I. Your name and domicile or any other means to answer your request. II. The documents proving your identity or, if applicable, your legal powers. III. A clear and precise description of the personal data with regard to which any ARCO Rights are to be enforced. IV. Any other element or document facilitating the localization of your personal data. Data Controller shall inform to you, within a maximum term of twenty business days, from the date when Data Controller receives the relevant request, the resolution thereof. In case the request was accepted, the request shall become effective within the fifteen business days after the date when Data Controller communicates the resolution. In the event the information provided at your requests turns out to be untrue or insufficient or in the event they are not included the documents required to prove your identity or the relevant legal powers, the Data Controller, within the five business days after the receipt of the request, shall require that deficiencies be corrected in order to process the request. In which case, you shall have ten business days to fulfill the correction requirement, from the day after receipt thereof. The relevant request shall be deemed as not presented in case you fail to conduct the correction within said term. You may obtain the requested information or personal data by means of simple copies, electronic documents in conventional format (Word, PDF, etc.), by means of a restricted access authorized to the system processing your personal data (access) or through any other lawful means guaranteeing and accrediting the effective exercise of the requested right. Alternatively, the Data Subject may address his request through the address derechosarco@palaceresorts.com, fulfilling all the aforementioned requirements, establishing as Subject of the communication "ARCO Rights and/or Revocation of the consent”. The terms for the proceeding shall be the sames as the ones mentioned in the foregoing paragraph. The use of the electronic means for the enforcement of the ARCO rights authorizes data subject to reply the relevant request through the same means, unless data subject himself expressly and clearly indicates otherwise. You shall be responsible for the updating of your personal data possessed by the Data Controller. Therefore, you guarantee and shall bear the cost, at any time, for the truthfulness, accuracy, effectiveness and authenticity of the personal data provided. You commit to duly update them and to notify so to the Data Controller.

I. Consent Revocation.
You may revoke your consent for the processing of your personal data, without any retroactive effects, in case such a revocation does not entail that it is not possible to fulfill the obligations arising from an effective legal relation between you and the Data Controller. The procedure for the revocation of the consent, if applicable, shall be the same as the one established in section above for the exercise of the ARCO rights.

J. Limitations to the Disclosure of Your Personal Data.
You may limit the usage or disclosure of your personal data by addressing the relevant request to our Personal Data Department. The requirements for accrediting your identity, as well as the procedure for processing your request shall be the same as the ones indicated at section G) hereof (ARCO rights exercise).

K. Amendments or Updating to this Comprehensive Privacy Notice.
The Data Controller may amend, update, extend or otherwise change the form, content and scope hereof at any time and at its sole discretion. I such cases, Palace Premier® shall publish said amendments in the website www.palacepremier.com, section “Privacy Notices”.

Updated July 1, 2017